Security: Extract API credentials to separate config file

- Move API credentials from script.js to config.js
- Add config.js to .gitignore to prevent credential exposure
- Create config.example.js as template for new installations
- Add validation check for missing configuration
- Update index.html to load config.js before script.js

This change ensures API keys are never committed to the repository
while maintaining full functionality of the dashboard.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

.gitignore

@@ -1,5 +1,8 @@
 # API Configuration (contains sensitive API key)
-# Note: You should create a config-example.js template without the actual API key
+config.js
+
+# Test files
+schema-test.html
 
 # System files
 .DS_Store