Keep service credentials out of public ROS parameters - #775

The public simulator launches UniNavid with INNATE_SERVICE_KEY, then exposes that value as the ROS service_key parameter. A visitor can request /uninavid_node/get_parameters through the public /ws bridge. The same credential parameter pattern exists in the logger and training nodes.

Credentials now come directly from the local environment and are never declared as ROS parameters. The unused UniNavid /brain/backend_config credential subscription is removed as well, since anything sent on ROS is readable by bridge clients. Owner authentication and navigation configuration continue to use the existing environment; key changes require a node restart. Documentation is updated for the removed parameter/topic inputs.

Validation: reproduced baseline disclosure with a synthetic key through the actual aiohttp /ws front door, real RWS server and real UniNavid node inside a dedicated networkless ROS container. After the fix, credential reads return no value while normal forward_speed reads work; two hardened integration tests pass. No provider requests or robot motion. Live checks only listed parameter names on both simulator deployments; no live credential value was retrieved.

This draft is the smallest independent mitigation for the confirmed ROS disclosure. It does not remove keys from process environments or close separate file/provider-error paths; those are covered by paired follow-up drafts. Production remains unchanged until an approved image is released and old sessions are retired. Do not merge or mark ready without Axel's approval.