Remove hardcoded secrets and harden runtime configuration.

Secrets now come only from .env; config.sh fails fast without credentials.
Also fixes Java 21 detection in Makefile, async response parsing, and debug checks.

Co-authored-by: Cursor <cursoragent@cursor.com>