No default or weak passwords in config/docs

Example files and README docs are copied verbatim by developers setting up new environments. A .env.example containing a real-looking API key format like sk_test_51abc... trains developers to paste real keys into that pattern, and anyone who clones the repo might assume the example value is valid and try it. CWE-798 (Use of Hard-coded Credentials) and CWE-521 (Weak Password Requirements) both apply when examples provide credential values that normalize insecure patterns. OWASP A07 includes authentication failures caused by weak credential templates. An example with password: 'password' signals to every developer that weak passwords are acceptable.

Replace every credential-like value in example files and documentation with an unmistakably fake placeholder. The placeholder must be obviously non-functional — not a realistic-format key that someone might try to use.

# .env.example — correct
DATABASE_URL=postgresql://YOUR_DB_USER:YOUR_DB_PASSWORD@localhost/YOUR_DB_NAME
STRIPE_SECRET_KEY=sk_test_YOUR_STRIPE_KEY_HERE
OPENAI_API_KEY=YOUR_OPENAI_API_KEY
JWT_SECRET=YOUR_STRONG_RANDOM_SECRET_HERE

Acceptable placeholders: YOUR_X_HERE, CHANGEME, xxx_placeholder. Unacceptable: password, 12345, test, sk_test_51abc1234 (real-format). Audit every .env.example, docker-compose.yml, and README code block that contains a credential field.