fix(security): Remove hardcoded default IQ Server credentials

[abhu85]

Summary

This PR addresses security vulnerabilities related to hardcoded default credentials in nancy.

Security Fixes

Severity	Issue	CWE	Fix
Critical	Hardcoded default username admin	CWE-798	Removed default, now required
Critical	Hardcoded default token admin123	CWE-798	Removed default, now required
High	Default HTTP server URL	-	Removed default, now required

Breaking Changes

IQ Server credentials are now required and must be provided via one of:

• CLI flags: --iq-username, --iq-token, --iq-server-url
• Environment variables: IQ_USERNAME, IQ_TOKEN, IQ_SERVER
• Config file: ~/.iqserver/.iq-server-config

Files Changed

• internal/cmd/iq.go - Removed hardcoded defaults, added validation

Testing

• CI tests pass
• Manual verification with explicit credentials
• Verify error message when credentials missing

Fixes #288

---

Generated with Claude Code

[paul-botsco-2-0]

Thanks for the contribution. Unfortunately some of your commits don't meet our standards. All commits must be signed and have author information set.

The commits to review are:

• a75714ce2be16d577ee310d1d62e2604d45e3707 - unsigned commit 🔑

See Signed Commits.

[paul-botsco-2-0]

Thanks for the contribution. Before we can merge this, we need @abhu85 to sign the Contributor License Agreement

[madpah]

Thanks for the PR @abhu85 - but for Sonatype Community Projects we require all commits to be signed - please see https://contribute.sonatype.com.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[abhu85]

Hi, I've updated the commit with a verified signature. The commit is now signed with my SSH signing key registered on GitHub.

Could you please re-run the verification check? Thank you!

[abhu85]

@madpah Thanks for the heads up! I've now signed the commit with my SSH signing key that's registered on my GitHub account. The commit should show as "Verified" now. Please let me know if there's anything else needed.