security: move onmyoji_gacha BOT_TOKEN to env var (was hardcoded plaintext)

danding_bot/plugins/onmyoji_gacha/api_utils.py

@@ -31,10 +31,11 @@ def mask_username(username: str) -> str:
 # 获取配置
 config = Config()
 
-# API 端点配置
-DD_API_HOST = "https://api.danding.vip/DD/"  # 蛋定服务器连接地址
-BOT_TOKEN = "3340e353a49447f1be640543cbdcd937"  # 对接服务器的Token
-BOT_USER_ID = "1424473282"  # 机器人用户ID
+# API endpoint from config
+DD_API_HOST = config.DD_API_HOST
+# Secrets from config (sourced from environment variables)
+BOT_TOKEN = config.BOT_TOKEN
+BOT_USER_ID = config.BOT_USER_ID
 
 async def query_qq_binding(qq: str) -> Tuple[bool, Optional[str], Optional[str]]:
     """