fix: scrub hardcoded test credentials (#477) (#571)

Replace literal passwords in two testing-agent code samples with
environment-variable reads — the secure, idiomatic pattern for each
framework rather than a placeholder string:
- testing-api-tester.md: 'secure_password' -> process.env.TEST_USER_PASSWORD
- testing-performance-benchmarker.md: 'password123' -> __ENV.TEST_USER_PASSWORD (k6)

Removes the weak-credential examples flagged in #477 and models good
secrets hygiene for anyone copying these snippets.

Closes #477

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

testing/testing-api-tester.md

@@ -74,7 +74,7 @@ describe('User API Comprehensive Testing', () => {
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({
         email: 'test@example.com',
-        password: 'secure_password'
+        password: process.env.TEST_USER_PASSWORD
       })
     });
     const data = await response.json();