refactor: move sessionSecret+passwordHash to env vars, seed data/ from defaults/

- SESSION_SECRET and PASSWORD_HASH moved out of config.json into env vars
- data.ts: AppConfig no longer holds secrets; loadConfig/loadData seed from
  defaults/ on first run if data/ files are missing
- auth.ts: requireAuth/authRequest read SESSION_SECRET from process.env directly
- login/+server.ts: reads PASSWORD_HASH and SESSION_SECRET from process.env
- defaults/config.json: ships with image (no secrets)
- defaults/units.json: ships with image as initial unit data
- package.json: add dotenv dep; start/serve load .env via -r dotenv/config
- Dockerfile: copy defaults/ into image; data/ is PVC-only
- .env.example: documents required env vars for local dev
- Remove k8s/ — managed externally

.env.example

@@ -1 +1,10 @@
-ORIGIN=http://localhost:3000
+# Copy this to .env and fill in values for local development.
+# In production, set these as environment variables / Kubernetes secrets.
+
+# bcrypt hash of the admin password. Generate with:
+#   python3 -c "import bcrypt; print(bcrypt.hashpw(b'yourpassword', bcrypt.gensalt(rounds=12)).decode())"
+PASSWORD_HASH=
+
+# Random secret for signing session tokens. Generate with:
+#   openssl rand -hex 32
+SESSION_SECRET=