Secrets sweep: move hardcoded credentials out of tracked files into env files

Removed live secret literals from git-tracked code (all were on GitHub):

- deploy/reactor.py: Claude/Groq API keys, DB pass, Gmail/iCloud app passwords now from os.environ (loaded via systemd EnvironmentFile=/etc/jarvis-arc/reactor.env, root:www-data 0640)

- public_html/login.php: used a private hardcoded PDO connection; now uses config.php DB_* constants

- deploy/jarvis-backup.sh (runs via cron), jarvis-deploy.sh, jarvis-watchdog.sh: DB pass now sourced from /etc/jarvis/db.env (root:root 0600)

- removed dead agent/jarvis-arc-reactor.py (unreferenced old duplicate leaking an old Groq key + stale Ollama IP)

- added deploy/reactor.env.example and deploy/db.env.example templates

Verified live: reactor restarted with all 21 handlers + DB poller (job round-trip OK), login works, mysqldump auth via env OK.

NOTE: these keys remain in GitHub history and should be rotated (Claude/Groq/Gmail/iCloud/DB). Separate decision needed on INFRASTRUCTURE-REFERENCE.md (full cred doc still tracked) + history purge.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

public_html/login.php

@@ -1,6 +1,7 @@
 <?php
 ini_set('session.cache_limiter', '');
 header('Cache-Control: no-store, no-cache, must-revalidate, no-transform');
+require_once __DIR__ . '/../api/config.php';
 session_start();
 if (!empty($_SESSION['jarvis_token'])) { header('Location: /'); exit; }
 $error = '';
@@ -8,8 +9,8 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     $u = trim($_POST['username'] ?? '');
     $p = $_POST['password'] ?? '';
     if ($u && $p) {
-        $pdo = new PDO('mysql:host=localhost;dbname=jarvis_db;charset=utf8mb4',
-            'jarvis_user', 'J4rv1s_Pr0t0c0l_2026!',
+        $pdo = new PDO('mysql:host=' . DB_HOST . ';dbname=' . DB_NAME . ';charset=utf8mb4',
+            DB_USER, DB_PASS,
             [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
         $row = $pdo->prepare('SELECT * FROM users WHERE username=? LIMIT 1');
         $row->execute([$u]);