[Security] Hardcoded secrets + exported MainActivity

## Summary
Static analysis found 4 hardcoded secrets + 1 exported activity.

**Gitleaks detected:** API keys and private key patterns in source
**Semgrep detected:** Exported MainActivity without permission protection

**Fix:** Remove hardcoded secrets, add permission to exported activity.

**Scanner:** gitleaks + semgrep on proot-distro Ubuntu 25.10