feat: extract secrets to .env, remove hardcoded credentials

- Backend: .env file for DB/JWT/Redis/MinIO config, appsettings.json cleared
- Backend: Program.cs loads .env at startup (no extra NuGet packages)
- Frontend: .env files for VITE_API_URL, api-clients use import.meta.env
- Added vite-env.d.ts type declarations for both frontends
- All hardcoded localhost:5000 replaced with env variable
- Added .env.example template for onboarding

frontend-patient/src/pages/services/ReportUploadPage.tsx

@@ -38,7 +38,7 @@ export function ReportUploadPage() {
         const formData = new FormData();
         formData.append('file', file);
         const token = JSON.parse(localStorage.getItem('hrt_auth') || '{}')?.state?.token;
-        const res = await fetch('http://localhost:5000/api/files/upload', {
+        const res = await fetch(`${import.meta.env.VITE_API_URL}/api/files/upload`, {
           method: 'POST',
           headers: token ? { 'Authorization': `Bearer ${token}` } : {},
           body: formData,