Move hardcoded secrets to .env, add .env.example

Castopod password, DB password, BunnyCDN keys, Postiz JWT/IDs,
and monitoring token all moved to environment variables.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

deploy_stats_cron.sh

@@ -42,7 +42,7 @@ echo "podcast-stats: starting hourly loop"
 while true; do
     echo "$(date -u '+%Y-%m-%dT%H:%M:%SZ') Running stats update..."
     if python podcast_stats.py --json --upload 2>&1; then
-        curl -s "https://monitoring.macneilmediagroup.com/api/push/yk9tjJVUGVXhu4zjol2EvpepIlBTfFoD?status=up&msg=OK" > /dev/null
+        [ -n "$HEARTBEAT_URL" ] && curl -s "${HEARTBEAT_URL}?status=up&msg=OK" > /dev/null
         echo "  ...done, heartbeat sent"
     else
         echo "  ...failed, will retry next hour"