Drop the unused htpasswd file and the secret in the sms readme

Also rename the Outline env template to .env.j2 so it does not look like a dotenv file.

monitoring/files/passwd

@@ -1,2 +0,0 @@
-esp8266:esp8266
-nodered:nodered

outline/roles/outline/tasks/main.yaml

@@ -14,7 +14,7 @@
 
 - name: Upload the .env file
   template:
-    src: "files/.env"
+    src: "files/.env.j2"
     dest: "/var/lib/{{ host_directory }}/.env"
 
 - name: Create Outline container

sms-wa-bridge/readme.md

@@ -391,7 +391,7 @@ Then end to end, which is the only check that proves the whole path — and it
 ```bash
 curl -sS https://bridge.tanshu.dev/health
 curl -sS -X POST https://bridge.tanshu.dev/sms \
-  -H 'X-Auth: 64f205031acc01744b6edc23' \
+  -H "X-Auth: $AUTH_SECRET" \
   -H 'Content-Type: application/json' \
   -d '{"from":"HDFC Bank","text":"Your OTP is 123456"}'
 # sent x2
@@ -405,7 +405,7 @@ Finally, reboot the host and confirm the unit returns unattended — without
 ## Cutover
 
 One change on each phone: the MacroDroid HTTP action URL becomes
-`https://bridge.tanshu.dev/sms`. The header (`X-Auth: 64f205031acc01744b6edc23`)
+`https://bridge.tanshu.dev/sms`. The header `X-Auth: <auth_secret>`
 and the body (`{"from":"{sms_number}","text":"{sms_text}"}`) stay exactly as they
 are — the goal of the whole arrangement is that nothing else has to be touched.