security: 移除 hard-coded FUNCTION_TOKEN，改從 env 讀取

- pokemon_location_fetcher.py：DEFAULT_URL/TOKEN 改走 os.getenv，並補 load_dotenv() 讓 fetch_and_upload.sh 能從 .env 取值
- run_pokemon_radar_api.sh：POKER_* 改為可由環境覆蓋（實務上未被 API 使用，保留結構）
- pyproject.toml：補宣告 python-dotenv（專案已使用但原本未列）

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

uv.lock

@@ -1,5 +1,5 @@
 version = 1
-revision = 2
+revision = 3
 requires-python = ">=3.10"
 
 [[package]]
@@ -321,6 +321,7 @@ dependencies = [
     { name = "fastapi" },
     { name = "httpx" },
     { name = "loguru" },
+    { name = "python-dotenv" },
     { name = "redis" },
     { name = "requests" },
     { name = "rich" },
@@ -332,6 +333,7 @@ requires-dist = [
     { name = "fastapi" },
     { name = "httpx", specifier = ">=0.28.1" },
     { name = "loguru", specifier = ">=0.7.3" },
+    { name = "python-dotenv", specifier = ">=1.0.0" },
     { name = "redis", specifier = ">=7.1.0" },
     { name = "requests" },
     { name = "rich", specifier = ">=14.2.0" },