Remove hardcoded secrets from public repo

- Replace hardcoded POSTGRES_PASSWORD, ADMIN_TOKEN, and L1 host IP
  with env var references in docker-compose.yml
- Remove default password fallback from database.py and app/config.py
- Update .env.example with required POSTGRES_PASSWORD, ADMIN_TOKEN, L1_HOST
- Update README to mark DATABASE_URL as required

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

README.md

@@ -60,7 +60,7 @@ The stack includes:
 | `HOST` | `0.0.0.0` | Server bind address |
 | `PORT` | `8000` | Server port |
 | `REDIS_URL` | `redis://localhost:6379/5` | Redis connection |
-| `DATABASE_URL` | `postgresql://artdag:artdag@localhost:5432/artdag` | PostgreSQL connection |
+| `DATABASE_URL` | **(required)** | PostgreSQL connection |
 | `CACHE_DIR` | `~/.artdag/cache` | Local cache directory |
 | `IPFS_API` | `/dns/localhost/tcp/5001` | IPFS API multiaddr |
 | `IPFS_GATEWAY_URL` | `https://ipfs.io/ipfs` | Public IPFS gateway |