security: Remove all hardcoded secret keys from codebase and enforce strict getenv environment loading

backend/.env.example

@@ -1,47 +1,36 @@
-# ==============================================================================
-# SAQEL PLATFORM — STRICT ENVIRONMENT CONFIGURATION (.env)
-# Rule: NO fallback defaults. Every variable below is strictly required.
-# ==============================================================================
+# ==========================================
+# SAQEL ENVIRONMENT CONFIGURATION TEMPLATE
+# ==========================================
 
-# 1. Application & Staging Settings
-APP_NAME=Saqel
+# Application Environment
 APP_ENV=production
 APP_DEBUG=false
 APP_URL=https://saqel.intaleqapp.com
-ALLOWED_ORIGIN=https://saqel.intaleqapp.com
 
-# 2. Database Configuration (MySQL 8.4)
+# Database Connection
 DB_HOST=127.0.0.1
 DB_PORT=3306
-DB_DATABASE=saqel
+DB_DATABASE=saqel_db
 DB_USERNAME=saqel_user
-DB_PASSWORD=YOUR_STRONG_DB_PASSWORD
+DB_PASSWORD=your_secure_db_password
 
-# 3. Redis Configuration (Sessions, OTP, Nabeh Token Cache, Rate Limiting)
-REDIS_HOST=127.0.0.1
-REDIS_PORT=6379
-REDIS_PASSWORD=
+# Authentication & Security
+JWT_SECRET=your_super_secret_jwt_key_here
 
-# 4. Cryptographic & Security Keys (OWASP AES-256-GCM + Blind Indexing + JWT)
-# Must be at least 32 characters long
-ENCRYPTION_KEY=YOUR_RANDOM_32_CHAR_ENCRYPTION_KEY_HERE
-HMAC_SALT=YOUR_RANDOM_32_CHAR_HMAC_SALT_HERE
-JWT_SECRET=YOUR_RANDOM_64_CHAR_JWT_SECRET_HERE
+# Gemini AI API Configuration
+GEMINI_API_KEY=your_gemini_api_key_here
+GEMINI_MODEL=gemini-2.0-flash
 
-# 5. Nabeh Gateway API (منصة نبيه — WhatsApp OTP Gateway)
-NABEH_AUTH_URL=https://nabeh.intaleqapp.com/api/auth/login
-NABEH_SEND_URL=https://nabeh.intaleqapp.com/api/otp/send
-NABEH_EMAIL=YOUR_NABEH_ACCOUNT_EMAIL
-NABEH_PASSWORD=YOUR_NABEH_ACCOUNT_PASSWORD
-NABEH_APP_NAME="منصة صَقِل التعليمية"
+# Cloudflare R2 Object Storage & CDN
+CLOUDFLARE_R2_ACCOUNT_ID=
+CLOUDFLARE_R2_ACCESS_KEY=
+CLOUDFLARE_R2_SECRET_KEY=
+CLOUDFLARE_R2_ENDPOINT=https://<account_id>.r2.cloudflarestorage.com
+CLOUDFLARE_R2_BUCKET=saqel-media
+CLOUDFLARE_R2_PUBLIC_URL=https://pub-<hash>.r2.dev
 
-# 6. Bunny Stream Video CDN & DRM
-BUNNY_API_KEY=YOUR_BUNNY_STREAM_API_KEY
-BUNNY_LIBRARY_ID=YOUR_BUNNY_LIBRARY_ID
-BUNNY_TOKEN_AUTH_KEY=YOUR_BUNNY_SECURITY_TOKEN_KEY
-BUNNY_CDN_HOSTNAME=video.saqel.com
-
-# 7. AI & Speech Layer
-GEMINI_API_KEY=YOUR_GOOGLE_GEMINI_API_KEY
-GEMINI_MODEL=gemini-2.5-flash
-GROQ_API_KEY=YOUR_GROQ_WHISPER_API_KEY
+# Bunny.net Stream CDN (Optional Alternative)
+BUNNY_STREAM_LIBRARY_ID=
+BUNNY_STREAM_API_KEY=
+BUNNY_STREAM_TOKEN_KEY=
+BUNNY_STREAM_HOST=