fix: remove hardcoded credentials from .env.example and source

- .env.example: placeholder values only
- gemini.go: error on missing API key instead of fallback
- main.go: dynamic from address from SMTP_USER
- Security: old credentials removed from active codebase

.env.example

@@ -1,27 +1,29 @@
-# ExpenseFlow Configuration
+# ReceiptNext Configuration
 # Copy this file to .env and fill in your credentials.
+# Run `sudo ./install.sh` for interactive setup.
 
-# SMTP Configuration
-SMTP_HOST=smtp.openxchange.eu
-SMTP_PORT=587
-SMTP_USER=post@2-4-h.app
-SMTP_PASS=D9AW8JP74r1V
-
-# --- AI Provider Configuration ---
-# Choose one: gemini (default), openai, ollama
+# --- AI Provider ---
+# Choose one: gemini, openai, ollama
 AI_PROVIDER=gemini
 
-# Gemini (default, used when AI_PROVIDER=gemini)
-GEMINI_API_KEY=AQ.Ab8RN6IQjKTQofuKOW2TT5mZ0zwt8rFa8X3SHGyYyce4DrbBJw
+# For AI_PROVIDER=gemini:
+# GEMINI_API_KEY=your-gemini-api-key
 
-# OpenAI / Compatible (used when AI_PROVIDER=openai)
+# For AI_PROVIDER=openai:
 # OPENAI_API_KEY=sk-...
 # AI_MODEL=gpt-4o-mini
 # AI_BASE_URL=https://api.openai.com/v1
 
-# Ollama - Local LLM (used when AI_PROVIDER=ollama)
+# For AI_PROVIDER=ollama:
 # AI_BASE_URL=http://localhost:11434
-# AI_MODEL=llava
+# AI_MODEL=qwen3.5:2b
 
-# Base URL for generating absolute links in emails
+# --- SMTP (optional — needed for OTP emails and report delivery) ---
+# SMTP_HOST=smtp.example.com
+# SMTP_PORT=587
+# SMTP_USER=your-email@example.com
+# SMTP_PASS=your-password
+
+# --- General ---
+PORT=8080
 BASE_URL=http://localhost:8080

internal/ai/gemini.go

@@ -68,7 +68,7 @@ func (p *geminiProvider) ExtractReceipt(imagePath string) (*ReceiptData, error)
 
 	apiKey := os.Getenv("GEMINI_API_KEY")
 	if apiKey == "" {
-		apiKey = "AQ.Ab8RN6IQjKTQofuKOW2TT5mZ0zwt8rFa8X3SHGyYyce4DrbBJw"
+		return &ReceiptData{}, errors.New("GEMINI_API_KEY environment variable not set")
 	}
 
 	b64Data := base64.StdEncoding.EncodeToString(imageData)

main.go

@@ -73,7 +73,7 @@ func main() {
 	// Create the email sender only if SMTP credentials are configured.
 	var emailSender *email.Sender
 	if smtpHost != "" && smtpPort != "" && smtpUser != "" && smtpPass != "" {
-		emailSender = email.NewSender(smtpHost, smtpPort, smtpUser, smtpPass, "post@2-4-h.app")
+		emailSender = email.NewSender(smtpHost, smtpPort, smtpUser, smtpPass, smtpUser)
 		log.Printf("INFO  [%s] main: SMTP sender configured (%s:%s)",
 			time.Now().Format(time.RFC3339), smtpHost, smtpPort)
 	} else {