refactor: move more sensitive values into .env for simpler configuration

- Move Vikunja DB user/password/database and JWT secret to environment variables
- Update .env.example with clear sections and 'change-me' placeholders
- Update SECURITY.md to reflect that more secrets now live in .env

SECURITY.md

@@ -28,3 +28,12 @@ The `docker-compose.yml` file contains placeholder values (`***`) for sensitive
 - Vikunja JWT secret
 
 **Change these values** before deploying anywhere security matters. Never use the default placeholders in production or shared environments.
+
+## Environment File
+
+The `.env` file now contains additional sensitive values including:
+
+- Database credentials
+- Vikunja JWT secret
+
+**Never commit your `.env` file.** Always use `.env.example` as a template and keep real values private.