Security: Extract API credentials to separate config file

- Move API credentials from script.js to config.js
- Add config.js to .gitignore to prevent credential exposure
- Create config.example.js as template for new installations
- Add validation check for missing configuration
- Update index.html to load config.js before script.js

This change ensures API keys are never committed to the repository
while maintaining full functionality of the dashboard.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

index.html

@@ -106,6 +106,7 @@
         </section>
     </div>
 
+    <script src="config.js"></script>
     <script src="script.js"></script>
 </body>
 </html>