Hardcoded default root/qwerty DB password and bot token in config

[consigcody94]

Found via code audit. src/common/config.py:31. Fallback defaults are qwerty and placeholder bot token. Fix: Refuse to start if env vars not set.