Security: remove hardcoded Appwrite API keys and rotate exposed credential #9

Problem

Multiple scripts in scripts/ contain a hardcoded Appwrite API key (standard_...) committed directly in source.

Evidence

Examples include:

• scripts/setup-appwrite.ts
• scripts/create-storage-buckets.ts
• scripts/sync-aanya.ts
• scripts/upload-about-images.ts
• scripts/verify_uploads.ts

(Detected across 25 script files.)

Risks

• Credential exposure in git history
• Unauthorized Appwrite access if key is reused
• Hard to rotate/update safely

Required Work

1. Rotate/revoke the currently exposed Appwrite key immediately.
2. Replace hardcoded key usage with environment-variable loading (APPWRITE_API_KEY) in every script.
3. Add a shared script utility for Appwrite client init so secret handling is centralized.
4. Add a secret scan check in CI (e.g., gitleaks or trufflehog).
5. Add .env.example entries for all required script env vars.

Acceptance Criteria

• No standard_ key literals remain in tracked files.
• All scripts fail fast with a clear message if APPWRITE_API_KEY is missing.
• Secret scan runs in CI and passes.