security: remove hardcoded API keys and environment setup

.gitignore

@@ -22,10 +22,25 @@ yarn-error.log*
 frontend/dist/
 frontend/.vite/
 
-# Environment variables
+# Environment variables and secrets
 .env
 .env.local
 .env.*.local
+.env.production
+.env.development
+.env.test
+*.env
+*_secrets.json
+*_credentials.json
+secrets/
+credentials/
+*.key
+*.pem
+*.p12
+*.crt
+*.cer
+config/secrets.yml
+config/credentials.yml
 
 # IDE
 .vscode/

DEPLOYMENT_GUIDE.md

@@ -33,7 +33,7 @@ Complete guide for deploying the PDDL RLHF system to Vercel (frontend) and Railw
    - Click "Variables" tab
    - Add variable:
      - Name: `FIREWORKS_API_KEY`
-     - Value: `fw_3ZHFp8ZR5WeoadXcFcjEKY4z` (or your API key)
+     - Value: Your Fireworks AI API key (get from https://fireworks.ai/)
 
 3. **Deployment Settings:**
    - Railway will auto-detect Python

QUICK_REFERENCE.md

@@ -64,7 +64,7 @@ npm install
 
 ### Backend
 ```bash
-FIREWORKS_API_KEY=fw_3ZHFp8ZR5WeoadXcFcjEKY4z
+FIREWORKS_API_KEY=your_fireworks_api_key_here
 PORT=8000
 ```