Move OAuth/GitHub secrets to environment variables

Replace hardcoded Google, Microsoft, and GitHub OAuth client IDs and
secrets with Environment.GetEnvironmentVariable() reads. Add .env.example
documenting the required variables. Update .gitignore to allow .env.example
while keeping .env ignored. This eliminates secret exposure in source control
and unblocks GitHub push protection.

Bump version: 1.46.2 → 1.46.3

Author: skmelendez

.env.example

@@ -0,0 +1,6 @@
+# OAuth provider credentials — required for Google, Microsoft, and GitHub connections.
+# Copy this file to .env and fill in the values.
+PRIVSTACK_GOOGLE_CLIENT_ID=
+PRIVSTACK_GOOGLE_CLIENT_SECRET=
+PRIVSTACK_MICROSOFT_CLIENT_ID=
+PRIVSTACK_GITHUB_CLIENT_ID=

.gitignore

@@ -57,6 +57,7 @@ test-data/
 # Secrets / env
 .env
 .env.*
+!.env.example
 *.pem
 *.key
 *.pfx

desktop/PrivStack.Desktop/PrivStack.Desktop.csproj

@@ -15,7 +15,7 @@
     <CFBundleDisplayName>PrivStack</CFBundleDisplayName>
     <AssemblyTitle>PrivStack</AssemblyTitle>
     <Product>PrivStack</Product>
-    <Version>1.46.2</Version>
+    <Version>1.46.3</Version>
   </PropertyGroup>
 
   <ItemGroup>

desktop/PrivStack.Desktop/Services/Connections/GitHubDeviceFlowService.cs

@@ -34,7 +34,9 @@ public sealed class GitHubDeviceFlowService
 
     // GitHub App client ID — permissions (issues:write, contents:write) are
     // configured on the app itself at https://github.com/settings/apps
-    private const string ClientId = "***REMOVED***";
+    private static readonly string ClientId =
+        Environment.GetEnvironmentVariable("PRIVSTACK_GITHUB_CLIENT_ID")
+        ?? throw new InvalidOperationException("PRIVSTACK_GITHUB_CLIENT_ID env var not set");
 
     private static HttpClient CreateHttpClient()
     {

desktop/PrivStack.Desktop/Services/Connections/OAuthProviderConfig.cs

@@ -36,8 +36,9 @@ public static bool IsOAuthProvider(string providerId) =>
     {
         ProviderId = "google",
         ProviderDisplayName = "Google",
-        ClientId = "***REMOVED***",
-        ClientSecret = "***REMOVED***",
+        ClientId = Environment.GetEnvironmentVariable("PRIVSTACK_GOOGLE_CLIENT_ID")
+            ?? throw new InvalidOperationException("PRIVSTACK_GOOGLE_CLIENT_ID env var not set"),
+        ClientSecret = Environment.GetEnvironmentVariable("PRIVSTACK_GOOGLE_CLIENT_SECRET"),
         AuthorizeEndpoint = "https://accounts.google.com/o/oauth2/v2/auth",
         TokenEndpoint = "https://oauth2.googleapis.com/token",
         Scopes = "https://mail.google.com/ https://www.googleapis.com/auth/calendar email openid",
@@ -49,7 +50,8 @@ public static bool IsOAuthProvider(string providerId) =>
     {
         ProviderId = "microsoft",
         ProviderDisplayName = "Microsoft",
-        ClientId = "***REMOVED***",
+        ClientId = Environment.GetEnvironmentVariable("PRIVSTACK_MICROSOFT_CLIENT_ID")
+            ?? throw new InvalidOperationException("PRIVSTACK_MICROSOFT_CLIENT_ID env var not set"),
         AuthorizeEndpoint = "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
         TokenEndpoint = "https://login.microsoftonline.com/common/oauth2/v2.0/token",
         Scopes = "https://outlook.office365.com/IMAP.AccessAsUser.All https://outlook.office365.com/SMTP.Send offline_access openid email",