Remove exposed Auth0 credentials

[jmgasper]

What changed

• Cleared the committed Auth0 M2M client ID and client secret from .env.
• Replaced the duplicate concrete development client ID in DEPLOYMENT.md with its placeholder form.

Why

The archived backup branch still contained the reported development Auth0 M2M credentials at its tip. Removing the values prevents continued exposure from current branch content while leaving Git history unchanged as requested.

Impact

There are no application logic changes. Deployments using this branch must provide the Auth0 M2M client ID and secret through their environment or deployment configuration.

Root cause

Local development credential values were committed in a tracked environment file, and the client ID was also copied into a deployment example.

Checks

• Exact-value scan of the resulting branch tip: no matches for either reported credential.
• git diff --check: passed with the repository configured to recognize its existing CRLF .env line endings.
• cdk: npm run build passed.
• submission-watcher-lambda: npm run build reaches tsc but exits because this branch has no tsconfig.json or TypeScript input files (pre-existing repository baseline).
• npm lint: unavailable in both relevant packages because neither defines a lint script.