[KARLalpha4768]

Addresses SEC-06 and the hardcoded-secret findings.

• Cesium Ion token removed from the frontend; served from env CESIUM_ION_TOKEN by a new /api/config endpoint (vercel.json route added).
• api_server.py: hardcoded demo API key replaced by SF_API_KEY with constant-time compare; fails closed if unset.
• postgis_catalog.py, alembic.ini, api docs: hardcoded DSN replaced by DATABASE_URL.
• digital_twin.html: object list built with textContent instead of innerHTML (XSS).
• .env.example documents variable names with placeholders only; .env is ignored.

Action required: the old Cesium token remains in git history and must be rotated. alembic.ini now uses %(DATABASE_URL)s, which requires DATABASE_URL to be passed into the Alembic config (no env.py in the repo yet). The k8s ConfigMap DSN is removed in fix/infra-hardening.

Verified (outside the Codex sandbox, Python 3.13.12 on Windows): python -m py_compile on every changed .py and node --check on every changed .js on this branch: 0 failures. pytest -q: 25 passed (baseline before changes: 25 passed). Secret scan: no hardcoded demo API key, Cesium-style JWT token, or postgres credentials remain once all five PRs are merged (each branch alone only removes its own items).

Not verified: docker build (Docker not available on the dev PC), terraform validate/plan, runtime/deployment tests. The existing tests do not exercise most changed code. Changes drafted with headless Codex and reviewed by hand.

One of five PRs splitting the HIGH findings from antigravity-findings-v2: fix/secrets-env, fix/api-nlp-lockdown, fix/docker-build, fix/infra-hardening, fix/correctness-high.