Add .env file to keep API token out of GitHub

[sruben-data]

This is more of an enterprise-level practice, for now, the config.py performs the same function

https://dev.to/technoph1le/how-to-store-api-keys-securely-in-a-env-file-32eo
https://dotenvx.com/docs/env-file