Remove hardcoded secrets from public repo

- Replace hardcoded POSTGRES_PASSWORD, ADMIN_TOKEN, and L1 host IP
  with env var references in docker-compose.yml
- Remove default password fallback from database.py and app/config.py
- Update .env.example with required POSTGRES_PASSWORD, ADMIN_TOKEN, L1_HOST
- Update README to mark DATABASE_URL as required

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/config.py

@@ -33,9 +33,7 @@ class Settings:
 
     # Database
     database_url: str = field(
-        default_factory=lambda: os.environ.get(
-            "DATABASE_URL", "postgresql://artdag:artdag@localhost:5432/artdag"
-        )
+        default_factory=lambda: os.environ.get("DATABASE_URL", "")
     )
 
     # IPFS