Security: Move hardcoded RPC API key to environment variable in test file

[Zena-park]

Context

Flagged in PR #35 code review (comment).

Problem

crates/desktop-app/local-server/test-e2e-fork.js contains a hardcoded Sepolia RPC API key/token in the source code.

Proposed Fix

1. Replace with process.env.SEPOLIA_RPC_URL and fail with a clear message if not set
2. Rotate the exposed key