security: move hardcoded passwords to .env, fix file permissions

- Move ROA_API_PASSWORD and ORACLE_PASSWORD to .env
- Update process_bon.py to use python-dotenv
- chmod 600 on .env and credentials/*
- Install python-dotenv dependency

memory/approved-tasks.md

@@ -6,6 +6,10 @@ Job-ul night-execute procesează tot din "Noaptea asta".
 
 ## 🌙 Noaptea asta
 
+**Din raport 3 feb seara:**
+- [ ] A0: Cold email sistem MINIMAL - scraper leads + template email
+- [ ] A3: Audit securitate Clawdbot
+
 **Analiză sistem:**
 - [x] ANALIZĂ: Sistem import bonuri PDF via Telegram/Discord/WhatsApp → roa2web
   - ✅ Salvat: memory/kb/projects/analiza-import-bonuri-pdf.md
@@ -18,10 +22,10 @@ Job-ul night-execute procesează tot din "Noaptea asta".
   - ⚠️ YouTube rate-limited (429) - retry mâine
 
 **Primit seara:**
-- [ ] https://youtu.be/lxfakTpdz1Y
-  - ⚠️ YouTube rate-limited (429) - retry mâine
-- [ ] https://youtu.be/4_2j5wgt_ds
-  - ⚠️ YouTube rate-limited (429) - retry mâine
+- [x] https://youtu.be/lxfakTpdz1Y ✅ 2026-02-03
+  - Notă: memory/kb/youtube/2026-02-03_clawdbot-cost-optimization-setup.md
+- [x] https://youtu.be/4_2j5wgt_ds ✅ 2026-02-03
+  - Notă: memory/kb/youtube/2026-02-03_claude-code-task-system-anti-hype.md
 
 **Monica Ion:**
 - [x] https://www.youtube.com/watch?v=kYF1sPTkuNM (Povestea lui Marc #3)