fix(OPENFRAM-004-8): CU-86akbhhb3 2 review findings in openframe-api.yml

[flamingo]

Closes 2 review findings in configs/base/openframe-api.yml.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🟡 70 medium	Hardcoded OAuth client secret literal in openframe-api.yml base config	configs/base/openframe-api.yml:106
2	🟡 65 medium	Hardcoded NATS credentials in openframe-api.yml base config	configs/base/openframe-api.yml:95

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: c1688cba-c9bc-481b-b917-2b7f45403ab4

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akbhhb3 OpenFrame config secret and property fixes (6 PRs)

[flamingo]

🦩 What this fix changed, finding by finding

2 finding(s) fixed in this draft — 2 explained inline on the diff.

[flamingo]

🦩 🔴 Hardcoded OAuth client secret literal in openframe-api.yml base config

In the nats.spring block, replaced bare literals username: service and password: service_pass with environment-variable placeholders ${NATS_USERNAME:service} and ${NATS_PASSWORD:service_pass}, keeping the original values as defaults to preserve local/dev behavior while allowing override via env vars per OPENFRAM-004-8.

🤖 Prompt for AI agents

In configs/base/openframe-api.yml around line 106, review and complete this code-review fix: Hardcoded OAuth client secret literal in openframe-api.yml base config.
What the draft fix changed: In the `nats.spring` block, replaced bare literals `username: service` and `password: service_pass` with environment-variable placeholders `${NATS_USERNAME:service}` and `${NATS_PASSWORD:service_pass}`, keeping the original values as defaults to preserve local/dev behavior while allowing override via env vars per OPENFRAM-004-8.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 70 medium — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🔴 Hardcoded NATS credentials in openframe-api.yml base config

In the oauth.client.default block, replaced the bare literal secret: prod_secret with secret: ${OAUTH_CLIENT_DEFAULT_SECRET} (no default value included, since the literal appeared to be a leaked/placeholder production secret that should not be preserved anywhere in the repo). This requires the environment variable to be set in all environments using this base config; a complete fix should also confirm the secret is rotated since it may have been exposed.

🤖 Prompt for AI agents

In configs/base/openframe-api.yml around line 95, review and complete this code-review fix: Hardcoded NATS credentials in openframe-api.yml base config.
What the draft fix changed: In the `oauth.client.default` block, replaced the bare literal `secret: prod_secret` with `secret: ${OAUTH_CLIENT_DEFAULT_SECRET}` (no default value included, since the literal appeared to be a leaked/placeholder production secret that should not be preserved anywhere in the repo). This requires the environment variable to be set in all environments using this base config; a complete fix should also confirm the secret is rotated since it may have been exposed.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 65 medium — react 👍/👎 to teach the reviewer