fix(security): revert synchronize:true → prod-safe + .env.example placeholders

src/app.module.ts

@@ -25,7 +25,7 @@ import { HealthController } from './common/health.controller';
         type: 'mysql',
         url: config.get<string>('DATABASE_URL'),
         autoLoadEntities: true,
-        synchronize: true, // first deploy only — revert after tables created
+        synchronize: config.get('NODE_ENV') !== 'production',
         logging: config.get('NODE_ENV') === 'development',
       }),
     }),