Security: Replace hardcoded passwords with placeholders

- Replace kawa:kawa123@100.64.0.1:4222 with NATS placeholders
- Replace initialPassword 'kawa2026' with <INITIAL_PASSWORD>
- Update README with password placeholders
- Add security notes for default credentials

Safe for public release.

modules/kawa-physical.nix

@@ -63,7 +63,7 @@
   users.users.kawa = {
     isNormalUser = true;
     extraGroups = [ "wheel" "networkmanager" "tailscale" ];
-    initialPassword = "kawa2026";
+    initialPassword = "<INITIAL_PASSWORD>";
   };
 
   # Firewall