db creds: move ClickHouse user/password to gitignored .env via compose env_file; drop hardcoded default from main.py

.gitignore

@@ -6,3 +6,4 @@ __pycache__/
 static/assets/
 static/index.html
 static/next/
+.env

docker-compose.yml

@@ -5,6 +5,8 @@ services:
     container_name: mapdash
     restart: unless-stopped
     networks: [edge]
+    env_file:
+      - .env
     volumes:
       - ./static:/app/static:ro
 networks:

main.py

@@ -7,7 +7,9 @@ from fastapi.staticfiles import StaticFiles
 CH_HOST = os.environ.get("CLICKHOUSE_HOST", "ClickHouse")
 CH_PORT = os.environ.get("CLICKHOUSE_PORT", "8123")
 CH_USER = os.environ.get("CLICKHOUSE_USER", "default")
-CH_PASSWORD = os.environ.get("CLICKHOUSE_PASSWORD", "1234567890")
+# Credentials come from the environment (see .env / docker-compose env_file).
+# No secret is kept in source; empty default fails fast if the env is missing.
+CH_PASSWORD = os.environ.get("CLICKHOUSE_PASSWORD", "")
 CH_URL = f"http://{CH_HOST}:{CH_PORT}/"
 
 app = FastAPI()