refactor: move more sensitive values into .env for simpler configuration

- Move Vikunja DB user/password/database and JWT secret to environment variables
- Update .env.example with clear sections and 'change-me' placeholders
- Update SECURITY.md to reflect that more secrets now live in .env

.env.example

@@ -20,3 +20,14 @@ VIKUNJA_SERVICE_PUBLICURL=http://vikunja.your-tailnet.ts.net
 
 # Frontend URL (usually the same as PUBLICURL)
 VIKUNJA_SERVICE_FRONTENDURL=http://vikunja.your-tailnet.ts.net
+
+# ==========================================
+# Database Configuration (Vikunja)
+# ==========================================
+
+VIKUNJA_DATABASE_USER=vikunja
+VIKUNJA_DATABASE_PASSWORD=change-me
+VIKUNJA_DATABASE_DATABASE=vikunja
+
+# Vikunja JWT secret (change this!)
+VIKUNJA_SERVICE_JWTSECRET=change-me