security: remove hardcoded API keys, add .env support (fixes #26)

- Remove plaintext Ximilar and Perplexity API keys from start-lab.bat
- Remove hardcoded key defaults from lab_api.py, lab_api_backup.py, lab_api_new.py
- start-lab.bat now reads from environment variables or .env file
- Add .env.example with placeholder values
- .env already in .gitignore (confirmed)
- Git history purged of all key values via git-filter-repo

Closes #26

.env.example

@@ -0,0 +1,11 @@
+# Commander AI Lab — Environment Variables
+# Copy this file to .env and fill in your API keys.
+# .env is gitignored and will NOT be committed.
+
+# Ximilar API Key (card scanner / visual AI recognition)
+# Get yours at: https://app.ximilar.com/
+XIMILAR_API_KEY=your-ximilar-api-key-here
+
+# Perplexity API Key (AI deck research & generation)
+# Get yours at: https://www.perplexity.ai/settings/api
+PPLX_API_KEY=your-perplexity-api-key-here

lab_api.py

@@ -954,9 +954,9 @@ def parse_args():
     parser.add_argument("--lab-jar", default=os.environ.get("LAB_JAR", ""),
                         help="Path to commander-ai-lab.jar (default: auto-detect from target/)")
     parser.add_argument("--port", type=int, default=int(os.environ.get("LAB_PORT", "8080")))
-    parser.add_argument("--ximilar-key", default=os.environ.get("XIMILAR_API_KEY", "REDACTED_XIMILAR_KEY"),
-                        help="Ximilar API key for card scanner (visual AI recognition)")
-    parser.add_argument("--pplx-key", default=os.environ.get("PPLX_API_KEY", "REDACTED_PPLX_KEY"),
+    parser.add_argument("--ximilar-key", default=os.environ.get("XIMILAR_API_KEY", ""),
+                        help="Ximilar API key for card scanner (env: XIMILAR_API_KEY)")
+    parser.add_argument("--pplx-key", default=os.environ.get("PPLX_API_KEY", ""),
                         help="Perplexity API key for AI deck research/generation (env: PPLX_API_KEY)")
     parser.add_argument("--verbose", "-v", action="store_true",
                         help="Enable DEBUG-level logging (default: INFO)")

start-lab.bat

@@ -20,11 +20,21 @@ set FORGE_DECKS_DIR=%APPDATA%\Forge\decks\commander
 REM ── Lab JAR (auto-detected from target/) ───────────────────
 set LAB_PORT=8080
 
-REM ── Ximilar API Key for Card Scanner ────────────────────────
-set XIMILAR_API_KEY=REDACTED_XIMILAR_KEY
-
-REM ── Perplexity API Key for AI Deck Research/Generation ─────
-set PPLX_API_KEY=REDACTED_PPLX_KEY
+REM ── API Keys (set via environment variables or .env file) ──
+REM  If not already set in your environment, create a .env file
+REM  in this directory (see .env.example) or set them manually:
+REM    set XIMILAR_API_KEY=your-ximilar-key-here
+REM    set PPLX_API_KEY=your-perplexity-key-here
+REM
+REM  Load from .env file if it exists and vars aren't already set
+if not defined XIMILAR_API_KEY (
+    if exist "%~dp0.env" (
+        for /f "usebackq tokens=1,* delims==" %%A in ("%~dp0.env") do (
+            if "%%A"=="XIMILAR_API_KEY" set XIMILAR_API_KEY=%%B
+            if "%%A"=="PPLX_API_KEY" set PPLX_API_KEY=%%B
+        )
+    )
+)
 
 echo.
 echo  ╔══════════════════════════════════════════════════╗