security: 移除 hard-coded FUNCTION_TOKEN，改從 env 讀取

- pokemon_location_fetcher.py：DEFAULT_URL/TOKEN 改走 os.getenv，並補 load_dotenv() 讓 fetch_and_upload.sh 能從 .env 取值
- run_pokemon_radar_api.sh：POKER_* 改為可由環境覆蓋（實務上未被 API 使用，保留結構）
- pyproject.toml：補宣告 python-dotenv（專案已使用但原本未列）

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

pokemon_location_fetcher.py

@@ -9,10 +9,14 @@ from datetime import datetime, timezone
 from typing import Optional, List, Dict, Any
 from zoneinfo import ZoneInfo
 
+from dotenv import load_dotenv
+
+load_dotenv()
+
 TAIPEI_TZ = ZoneInfo("Asia/Taipei")
 
-DEFAULT_URL = "http://192.168.42.124:13000/function"
-DEFAULT_TOKEN = "6R0W53R135510"
+DEFAULT_URL = os.getenv("FUNCTION_URL", "http://192.168.42.124:13000/function")
+DEFAULT_TOKEN = os.getenv("FUNCTION_TOKEN", "")
 
 CSV_FIELDS = [
     "id",