chore: drop migration leftovers, refresh env examples + secret-leak scope

- remove MONGODB_URI from .env.example (Atlas migration done; deleted from
  Vercel cloud env too)
- trim .env.deploy.example to vars actually consumed by deploy scripts
  (Upstash creds were only needed by the now-deleted migration script)
- README config table: drop ENV / SOURCE_COMMIT / SCHEDULE_CHECK_APP_TIME
  (never read by code; Java-era leftovers)
- check-secret-leaks: drop MONGODB_URI; add UPSTASH/KV/CRON tokens; widen
  scan roots to include api/
- add scripts/list-upstash-keys.js read-only ops helper

.env.example

@@ -19,6 +19,3 @@ CRON_SECRET=generate_another_random_string_at_least_32_chars
 ADMIN_IDS=123456789,987654321
 APP_CACHE_SECONDS=600
 NUM_DAYS_WARNING_NOT_UPDATED=30
-
-# One-shot migration only (Phase 5: legacy Atlas → Upstash). Remove after migration done.
-MONGODB_URI=mongodb+srv://user:pass@cluster.mongodb.net/dbname