chore: drop migration leftovers, refresh env examples + secret-leak scope

- remove MONGODB_URI from .env.example (Atlas migration done; deleted from
  Vercel cloud env too)
- trim .env.deploy.example to vars actually consumed by deploy scripts
  (Upstash creds were only needed by the now-deleted migration script)
- README config table: drop ENV / SOURCE_COMMIT / SCHEDULE_CHECK_APP_TIME
  (never read by code; Java-era leftovers)
- check-secret-leaks: drop MONGODB_URI; add UPSTASH/KV/CRON tokens; widen
  scan roots to include api/
- add scripts/list-upstash-keys.js read-only ops helper

.env.deploy.example

@@ -1,18 +1,11 @@
-# Operator-only file: holds the credentials the deploy + migrate scripts need.
+# Operator-only file: holds the credentials the deploy scripts need.
 # Copy to .env.deploy and fill in. NEVER commit .env.deploy.
 
-# Telegram (must match values set as Vercel env vars)
+# Telegram (must match values set as Vercel env vars).
+# Used by: scripts/register-webhook.js, scripts/set-bot-description.js
 TELEGRAM_BOT_TOKEN=
 TELEGRAM_WEBHOOK_SECRET=
 
-# Where Telegram should send webhook updates after Phase 6 cutover.
+# Where Telegram should send webhook updates.
 # Format: https://<your-vercel-url>/api/webhook
-# Variable name kept as WORKER_URL for register-webhook.js compatibility.
 WORKER_URL=https://store-scraper-bot.vercel.app/api/webhook
-
-# Upstash Redis credentials — required by migrate-atlas-to-upstash.js.
-# If the Vercel Marketplace Upstash integration is set up, the bot also
-# accepts KV_REST_API_URL / KV_REST_API_TOKEN as fallbacks (see upstash.js).
-UPSTASH_REDIS_REST_URL=
-UPSTASH_REDIS_REST_TOKEN=
-KEY_PREFIX=store-scraper-bot: