security: remove leaked Google API key from repository

Remove google-services.json from tracking and add it to .gitignore.
Add a .json.template placeholder with dummy values so developers know
the file structure. Update README to reflect auto-created admin user.

The leaked key (AIzaSyDsA2wgQIw-bVgwODNMIF482gVRn5xdANU) must still
be revoked in Google Cloud Console by the project owner.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

README.md

@@ -124,11 +124,9 @@ Run the full stack (backend, frontend, PostgreSQL, Redis, Celery) with a single
 
 ```bash
 # Start all services (first run will build images)
+# An admin user (admin@localhost / admin) is created automatically
 docker compose up --build
 
-# Create an admin user
-docker compose exec backend python manage.py createsuperuser
-
 # (Optional) Load sample data
 docker compose exec backend python manage.py seed_data --email admin@example.com
 ```

mobile/.gitignore

@@ -43,3 +43,7 @@ app.*.map.json
 /android/app/debug
 /android/app/profile
 /android/app/release
+
+# Firebase / Google Services — contains API keys
+**/google-services.json
+**/GoogleService-Info.plist

mobile/android/app/google-services.json

@@ -1,63 +0,0 @@
-{
-  "project_info": {
-    "project_number": "1072513761792",
-    "project_id": "bottlecrm-io",
-    "storage_bucket": "bottlecrm-io.firebasestorage.app"
-  },
-  "client": [
-    {
-      "client_info": {
-        "mobilesdk_app_id": "1:1072513761792:android:c170ae72445200ecd74ee5",
-        "android_client_info": {
-          "package_name": "io.bottlecrm"
-        }
-      },
-      "oauth_client": [
-        {
-          "client_id": "1072513761792-6cnavnfp5p4me4peah0vgoc477ndkd3h.apps.googleusercontent.com",
-          "client_type": 1,
-          "android_info": {
-            "package_name": "io.bottlecrm",
-            "certificate_hash": "5227cfe6b33aceb349e54aaf1ea3cfc191aef324"
-          }
-        },
-        {
-          "client_id": "1072513761792-r70ldlpqkbkb654tdpu41sqqrs5b4uf4.apps.googleusercontent.com",
-          "client_type": 1,
-          "android_info": {
-            "package_name": "io.bottlecrm",
-            "certificate_hash": "f980d3a3e81564ea45f3634dd706eb5261ec222b"
-          }
-        },
-        {
-          "client_id": "1072513761792-vp1nq9690h2v94oge513ejr7d01rh0e8.apps.googleusercontent.com",
-          "client_type": 1,
-          "android_info": {
-            "package_name": "io.bottlecrm",
-            "certificate_hash": "67c4be5a9739470b402c1405f181abc7e6cfa7df"
-          }
-        },
-        {
-          "client_id": "1072513761792-p59rct7b1c3go7l58e51r3geuqff2tfl.apps.googleusercontent.com",
-          "client_type": 3
-        }
-      ],
-      "api_key": [
-        {
-          "current_key": "AIzaSyDsA2wgQIw-bVgwODNMIF482gVRn5xdANU"
-        }
-      ],
-      "services": {
-        "appinvite_service": {
-          "other_platform_oauth_client": [
-            {
-              "client_id": "1072513761792-dvcv8cj147oj6nav40u7jfjp1r3f0a1d.apps.googleusercontent.com",
-              "client_type": 3
-            }
-          ]
-        }
-      }
-    }
-  ],
-  "configuration_version": "1"
-}

mobile/android/app/google-services.json.template

@@ -0,0 +1,25 @@
+{
+  "project_info": {
+    "project_number": "YOUR_PROJECT_NUMBER",
+    "project_id": "YOUR_PROJECT_ID",
+    "storage_bucket": "YOUR_PROJECT_ID.firebasestorage.app"
+  },
+  "client": [
+    {
+      "client_info": {
+        "mobilesdk_app_id": "YOUR_MOBILE_SDK_APP_ID",
+        "android_client_info": {
+          "package_name": "io.bottlecrm"
+        }
+      },
+      "oauth_client": [],
+      "api_key": [
+        {
+          "current_key": "YOUR_GOOGLE_API_KEY"
+        }
+      ],
+      "services": {}
+    }
+  ],
+  "configuration_version": "1"
+}