Security: Extract API credentials to separate config file

- Move API credentials from script.js to config.js
- Add config.js to .gitignore to prevent credential exposure
- Create config.example.js as template for new installations
- Add validation check for missing configuration
- Update index.html to load config.js before script.js

This change ensures API keys are never committed to the repository
while maintaining full functionality of the dashboard.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

script.js

@@ -1,9 +1,9 @@
-// API Configuration
-// IMPORTANT: Replace these values with your actual Unraid server details
-const API_CONFIG = {
-    serverUrl: 'http://YOUR_UNRAID_IP:PORT/graphql',
-    apiKey: 'YOUR_API_KEY_HERE'
-};
+// API Configuration is loaded from config.js
+// If API_CONFIG is not defined, the config.js file is missing
+if (typeof API_CONFIG === 'undefined') {
+    console.error('API_CONFIG is not defined. Please copy config.example.js to config.js and configure your credentials.');
+    alert('Configuration Error: config.js file is missing. Please check the console for details.');
+}
 
 // GraphQL query executor
 async function executeGraphQLQuery(query) {