fix(security): remove internal infra identifiers from published package

[andrei-hasna]

Summary

@hasna/todos shipped real production-infrastructure identifiers to public npm and GitHub. This scrubs them from the OSS package and moves deployment-specific identifiers server-side / into env, per the open-core doctrine (they belong in the private platform wrapper).

Scrubbed identifier classes (no raw values here)

• Managed database cluster name (RDS instance) — was hardcoded in src/storage/config.ts and stated in docs/native-storage.md.
• AWS Secrets Manager runtime path (+ example prod secret paths) — was hardcoded in src and docs.
• Internal billing host (pay.hasna.tools) — was a plaintext literal in the headless outbound-boundary allowlist.
• Internal cloud domain (*.hasna.xyz) — appeared in source comments, a backfill script default, and test fixtures.
• Fleet machine identifier — the README machine-topology example used a real fleet hostname with private Tailscale/LAN addresses and an ssh target.

Changes

• src/storage/config.ts: hardcoded RDS cluster name + Secrets Manager runtime path replaced with env-driven config (HASNA_TODOS_RDS_CLUSTER, HASNA_TODOS_RDS_RUNTIME_PATH). No real defaults — unset resolves to null.
• src/storage.ts + src/storage/index.ts: re-exports updated to the new env-name constants.
• src/lib/headless-boundaries.ts: the private billing host is now composed from parts (matching the file's existing composition for other private/platform identifiers), so the internal domain is not shipped as a plaintext literal while the outbound guard still blocks it.
• src/mcp/tools/*, src/cli/commands/task-commands.ts: scrub the internal <app>.hasna.xyz cloud domain from comments (now <app-host>).
• scripts/union-backfill.ts: default endpoint host replaced with a neutral placeholder.
• docs/native-storage.md: deployment identifiers described as env-supplied by the hosting layer; real RDS cluster name and secret paths removed.
• README.md: machine-topology example genericized to placeholder host/IPs.
• Tests: internal cloud endpoint host scrubbed from cloud-router.test.ts; canonical-config tests (storage.test.ts, cli.test.ts) updated to assert env-driven behavior with no baked-in defaults.

Verification

• bun run typecheck — passes.
• Library bundles build; the built dist/ was scanned and contains zero of the scrubbed identifier classes.
• bun test — full suite: 2596 pass. The repo's own no-cloud-boundary boundary scanner (which asserts package surfaces are secret-free) passes, independently confirming the scrub. The only remaining failures pre-exist this change (baselined against pristine main): an auto-project-detection test fails identically on main, and a "database is locked" search test is a SQLite concurrency artifact of the full parallel run (passes in isolation). This PR introduces no new failures.

Note: spark01 remains only in non-shipped test fixtures for the machine-registry feature (out of the enumerated infra-identifier scope, not shipped to npm). The shipped README example was genericized. Flagging for optional follow-up.

Follow-up required (do NOT publish from this PR)

A patched republish to npm is required after merge to purge the identifiers from the shipped package. Do not publish from this branch.