security: load vehicle API token from secret file

common.php

@@ -8,7 +8,16 @@ if (!is_file($carSecretFile)) {
     throw new RuntimeException('Missing car secret config: ' . $carSecretFile);
 }
 
+$carApiTokenFile = __DIR__ . '/../../config/.car-api-token.php';
+if (!is_file($carApiTokenFile) || !is_readable($carApiTokenFile)) {
+    throw new RuntimeException('Missing car API token file');
+}
+
 $carSecretConfig = require $carSecretFile;
+$carApiToken = trim((string)(require $carApiTokenFile));
+if ($carApiToken === '') {
+    throw new RuntimeException('Empty car API token file');
+}
 $carTcpConfig = is_array($carSecretConfig['tcp'] ?? null) ? $carSecretConfig['tcp'] : [];
 $carIdentityConfig = is_array($carSecretConfig['identity'] ?? null) ? $carSecretConfig['identity'] : [];
 $carDbConfig = is_array($carSecretConfig['db'] ?? null) ? $carSecretConfig['db'] : [];
@@ -30,7 +39,7 @@ define('DB_USER', (string)($carDbConfig['user'] ?? 'car'));
 define('DB_PASS', (string)($carDbConfig['pass'] ?? ''));
 define('DB_CHARSET', (string)($carDbConfig['charset'] ?? 'utf8mb4'));
 
-define('AUTH_TOKEN', (string)($carSecretConfig['auth_token'] ?? ''));
+define('AUTH_TOKEN', $carApiToken);
 
 define('ALLOWED_IPS', array_values(array_filter(
     (array)($carSecretConfig['allowed_ips'] ?? []),