Move hardcoded secrets to .env, add .env.example

Castopod password, DB password, BunnyCDN keys, Postiz JWT/IDs,
and monitoring token all moved to environment variables.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,48 @@
+# API Keys
+OPENROUTER_API_KEY=
+ELEVENLABS_API_KEY=
+INWORLD_API_KEY=
+OPENAI_API_KEY=
+
+# SignalWire (real callers)
+SIGNALWIRE_PROJECT_ID=
+SIGNALWIRE_SPACE=
+SIGNALWIRE_TOKEN=
+SIGNALWIRE_PHONE=
+SIGNALWIRE_STREAM_URL=
+
+# Social media
+TWITTER_API_KEY=
+TWITTER_API_SECRET=
+TWITTER_ACCESS_TOKEN=
+TWITTER_ACCESS_TOKEN_SECRET=
+CLIENT_SECRET_ID=
+CLIENT_SECRET=
+POSTIZ_URL=
+POSTIZ_API_KEY=
+BSKY_APP_PASSWORD=
+
+# Castopod
+CASTOPOD_USERNAME=admin
+CASTOPOD_PASSWORD=
+CASTOPOD_DB_PASS=
+
+# Postiz publishing
+POSTIZ_JWT_SECRET=
+POSTIZ_USER_ID=
+POSTIZ_INTEGRATIONS={}
+
+# BunnyCDN
+BUNNY_STORAGE_KEY=
+BUNNY_ACCOUNT_KEY=
+
+# Monitoring
+HEARTBEAT_URL=
+
+# Google AI
+GOOGLE_API_KEY=
+
+# Email (IMAP)
+SUBMISSIONS_IMAP_HOST=
+SUBMISSIONS_IMAP_USER=
+SUBMISSIONS_IMAP_PASS=