Hardcoded Trocador API key + referral code in trocador_api.dart

[ulsreall]

Summary

lib/services/exchange/trocador/trocador_api.dart contains a hardcoded production Trocador API key and referral code:

• API key: 8rFqf7QLxX1mUBiNPEMaLUpV2biz6n
• referral code: 9eHm9BkQfS

Impact

I verified the key is still live against api.trocador.app. It can:

• create real trades via /new_trade
• read trade data via /trade?id=
• set markup on rates (rate manipulation)

Since the repo is public, anyone can pull the key and operate under the app's partner account (rate limits, trades attributed to the app, etc.).

Suggested fix

• Rotate the key in Trocador's partner dashboard
• Move it to a build-time secret or backend proxy so it's not in the app binary / repo

Happy to provide more details if useful. Thanks!