fix(security): require DB_PASS and GITEA_TOKEN env vars

Removed hardcoded fallback secrets in app_server.py. Both env vars
are now required at startup — fail fast instead of silently using
production credentials baked into the source.

Why: discovered while mapping the leak radius of a separate Gitea
token during the LegalCrm 2026-04-25 security audit. Per the
Infisical-only secrets policy, hardcoded credentials in any source
file are Critical regardless of intent.

Note: deployment must set both env vars before restarting the
service; missing either now produces KeyError on startup.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app_server.py

@@ -34,10 +34,11 @@ DB_HOST = os.environ.get('DB_HOST', 'pss404gosg8oo0o8k40o4wco')
 DB_PORT = int(os.environ.get('DB_PORT', '5432'))
 DB_NAME = os.environ.get('DB_NAME', 'extension_platform')
 DB_USER = os.environ.get('DB_USER', 'postgres')
-DB_PASS = os.environ.get('DB_PASS', '9cugHhKR8bCFXzm')
+# Required env vars — fail fast if missing rather than fall back to a baked-in secret.
+DB_PASS = os.environ['DB_PASS']
 
 GITEA_URL = os.environ.get('GITEA_URL', 'https://gitea.dev.marcus-law.co.il')
-GITEA_TOKEN = os.environ.get('GITEA_TOKEN', '90acb3ebc0f98edfb7a373ef9902bde1cc8eff96')
+GITEA_TOKEN = os.environ['GITEA_TOKEN']
 GITEA_ORG = os.environ.get('GITEA_ORG', 'espocrm-extensions')
 
 DIST_DIR = os.environ.get('DIST_DIR', '/app/dashboard/dist')