Remove default/hardcoded secrets from repository

[RonaldRonnie]

Description:

Default credentials and placeholder secrets appear in committed files:

• application.yml: spring.security.user.name: admin, password: admin; jwt.secret set to a placeholder
• docker-compose.yml: SPRING_DATASOURCE_PASSWORD=password, POSTGRES_PASSWORD=password, JWT_SECRET=your-secret-key-here...
• env.example: same placeholder JWT secret and default DB passwords

These should not be usable as real secrets in any environment.

Acceptance criteria:

• No default or example passwords/secrets in application.yml; use placeholders that fail fast if not overridden (e.g. env vars)
• docker-compose.yml uses env vars (e.g. from .env) for all secrets; document that default values are dev-only
• env.example documents that all secrets must be changed; add warning in README