Security: Replace hardcoded passwords with placeholders

- Replace kawa:kawa123@100.64.0.1:4222 with NATS placeholders
- Replace initialPassword 'kawa2026' with <INITIAL_PASSWORD>
- Update README with password placeholders
- Add security notes for default credentials

Safe for public release.

kawa-voice-install.sh

@@ -87,7 +87,7 @@ import pyaudio
 import pyttsx3
 
 # Configuration
-NATS_SERVER = "ws://kawa:kawa123@100.64.0.1:4222"
+NATS_SERVER = "ws://<NATS_USER>:<NATS_PASSWORD>@<NATS_SERVER>"
 OLLAMA_SERVER = "http://100.64.0.7:11434"
 MODEL_PATH = os.path.expanduser("~/.local/share/vosk/vosk-model-fr")
 

modules/kawa-physical.nix

@@ -63,7 +63,7 @@
   users.users.kawa = {
     isNormalUser = true;
     extraGroups = [ "wheel" "networkmanager" "tailscale" ];
-    initialPassword = "kawa2026";
+    initialPassword = "<INITIAL_PASSWORD>";
   };
 
   # Firewall