security: 移除 hard-coded FUNCTION_TOKEN，改從 env 讀取

- pokemon_location_fetcher.py：DEFAULT_URL/TOKEN 改走 os.getenv，並補 load_dotenv() 讓 fetch_and_upload.sh 能從 .env 取值
- run_pokemon_radar_api.sh：POKER_* 改為可由環境覆蓋（實務上未被 API 使用，保留結構）
- pyproject.toml：補宣告 python-dotenv（專案已使用但原本未列）

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

pokemon_location_fetcher.py

@@ -9,10 +9,14 @@ from datetime import datetime, timezone
 from typing import Optional, List, Dict, Any
 from zoneinfo import ZoneInfo
 
+from dotenv import load_dotenv
+
+load_dotenv()
+
 TAIPEI_TZ = ZoneInfo("Asia/Taipei")
 
-DEFAULT_URL = "http://192.168.42.124:13000/function"
-DEFAULT_TOKEN = "6R0W53R135510"
+DEFAULT_URL = os.getenv("FUNCTION_URL", "http://192.168.42.124:13000/function")
+DEFAULT_TOKEN = os.getenv("FUNCTION_TOKEN", "")
 
 CSV_FIELDS = [
     "id",

pyproject.toml

@@ -10,5 +10,6 @@ dependencies = [
     "redis>=7.1.0",
     "loguru>=0.7.3",
     "rich>=14.2.0",
+    "python-dotenv>=1.0.0",
 ]
 

run_pokemon_radar_api.sh

@@ -1,9 +1,10 @@
 #!/usr/bin/env bash
 cd /opt/pokemon-radar-api
 
-export POKER_URL="http://192.168.42.124:13000/function"
-export POKER_TOKEN="6R0W53R135510"
-export POKER_SCRIPT="twpk_radar.mjs"
+# POKER_* 目前 unused（API 只讀 REDIS_*）；保留結構，實際值放 .env
+export POKER_URL="${POKER_URL:-}"
+export POKER_TOKEN="${POKER_TOKEN:-}"
+export POKER_SCRIPT="${POKER_SCRIPT:-twpk_radar.mjs}"
 
 # uv run uvicorn pokemon_radar_api:app --host 0.0.0.0 --port 8008
 

uv.lock

@@ -1,5 +1,5 @@
 version = 1
-revision = 2
+revision = 3
 requires-python = ">=3.10"
 
 [[package]]
@@ -321,6 +321,7 @@ dependencies = [
     { name = "fastapi" },
     { name = "httpx" },
     { name = "loguru" },
+    { name = "python-dotenv" },
     { name = "redis" },
     { name = "requests" },
     { name = "rich" },
@@ -332,6 +333,7 @@ requires-dist = [
     { name = "fastapi" },
     { name = "httpx", specifier = ">=0.28.1" },
     { name = "loguru", specifier = ">=0.7.3" },
+    { name = "python-dotenv", specifier = ">=1.0.0" },
     { name = "redis", specifier = ">=7.1.0" },
     { name = "requests" },
     { name = "rich", specifier = ">=14.2.0" },