fix: remove secret scanner alert, OLLAMA_HOST in embedding.py, exp08 JudgeClient mock

[KTS-o7]

Summary

Three follow-up fixes identified during code review of PR #8.

Changes

Security: remove credential pattern from .env.example

The comment block in .env.example contained an inline URI example in the form mongodb+srv://user:pass@cluster.mongodb.net/ which triggered GitHub's secret scanner alert. No real credentials were present — this was placeholder text. The comment has been rewritten as a plain description pointing users to the Atlas UI, removing the pattern that matched the scanner rule.

backend/app/core/embedding.py — read OLLAMA_HOST env var

EmbeddingCreator was hardcoding url="http://localhost:11435/api/embeddings" directly in the OllamaEmbeddingFunction constructor. Every other file in the backend (database_handlers.py, rag.py, log_parser.py) was updated in the previous round to read from os.environ.get("OLLAMA_HOST", "http://localhost:11435"). This makes embedding.py consistent with the rest of the codebase, so a non-default Ollama host only needs to be set in one place.

experiments/08_rag_real_world/run_experiment.py — fix silent mock scoring in JudgeClient

The JudgeClient class in experiment 08 was not updated when the identical class in experiment 07 was fixed. Specifically:

• _init_client() was silently setting self.client = None when OPENAI_API_KEY or GROQ_API_KEY were absent, instead of raising an error
• score() was returning a fixed 0.5 both on the null-client early-exit path and after retry exhaustion

A run with a missing or misconfigured API key would produce output indistinguishable from a real run, with fabricated scores. Both paths now match experiment 07: _init_client() raises ValueError on missing keys, and score() returns 0.0 with an explicit warning after retry exhaustion.

Related

Closes the remaining items from the review of #8.

cc @chxmq — tagging you for review since these are fixes to code you authored.