security: Remove hardcoded GLM API key from source files (use environment variable GLM_4_7_API_KEY)

RAG_FULL_APPLICATION_BACKEND/app/config.py

@@ -19,7 +19,7 @@ class Settings(BaseSettings):
     # LLM — Qwen3 & GLM-4.7-Flash
     QWEN3_MODEL_NAME: str = "Qwen/Qwen3-Demo"
     QWEN3_THINKING_BUDGET: int = 38
-    GLM_4_7_API_KEY: str = "04f83efc8d834ad599eedd505aa1a70f.o63P8xs622I2zg2Y"
+    GLM_4_7_API_KEY: str = ""
     GLM_BASE_URL: str = "https://api.z.ai/api/paas/v4/"
     GLM_MODEL_NAME: str = "glm-4.7-Flash"
     LLM_RESPONSE_TIMEOUT: int = 1080

RAG_FULL_APPLICATION_BACKEND/app/services/llm_service.py

@@ -13,7 +13,7 @@ logger = logging.getLogger(__name__)
 
 class GLM47Service:
     def __init__(self):
-        self.api_key = getattr(settings, "GLM_4_7_API_KEY", None) or os.getenv("GLM_4_7_API_KEY", "04f83efc8d834ad599eedd505aa1a70f.o63P8xs622I2zg2Y")
+        self.api_key = getattr(settings, "GLM_4_7_API_KEY", "") or os.getenv("GLM_4_7_API_KEY", "")
         self.base_url = getattr(settings, "GLM_BASE_URL", "https://api.z.ai/api/paas/v4/")
         self.model_name = getattr(settings, "GLM_MODEL_NAME", "glm-4.7-Flash")
         self._client = None