docs: add security best practices for API keys

[EasterRobert]

Include essential security tips to prevent users from accidentally exposing their private keys and credentials.

---

Note

Low Risk
Low risk documentation-only change; it adds guidance to reduce accidental credential exposure without affecting runtime behavior.

Overview
Adds a Security Best Practices section to README.md reminding users not to commit API_KEY/PRIVATE_KEY, to store credentials in .env, and to add .env to .gitignore.

^{Written by Cursor Bugbot for commit d6aac1a. This will update automatically on new commits. Configure here.}