Externalize hardcoded values (URLs, passwords, magic numbers)

[pcastelo]

Problem

Hardcoded values scattered across the codebase make it fragile and hard to configure for different environments.

Examples

• AI endpoint URL: https://litellm-prod.apps.maas.redhatworkshops.io/v1 in application.properties
• Default passwords: gateforge, changeme, dummy in properties and Helm values
• quarkus.langchain4j.openai.log-requests=true / log-responses=true — leaks prompts and API keys in logs
• Magic TTLs and timeouts without named constants
• FAQ prompts hardcoded in ChatResource

Acceptance criteria

• Extract all hardcoded URLs, passwords, and API keys to environment variables
• Use %dev profile for dev-only defaults (passwords, logging)
• Disable verbose LLM request/response logging in production profile
• Replace magic numbers with named constants
• Document all required environment variables in README