[Hard]: Security hardening for frontend secret handling and IPFS upload flow

### Context and Motivation

Sensitive credentials are exposed in frontend code/comments. This is a critical security risk and should be fixed before broader open-source contribution.

### Architecture Proposal

Remove all sensitive credentials from client files.
Introduce a secure backend or serverless endpoint for upload authorization.
Update frontend upload flow to call secure endpoint.
Ensure upload still works with the new secure path.
Document secure environment setup and secret rotation process.

### Cross-Repo Scope

event-dappp/src/components/CreateEventPage.jsx
event-dappp/src/index.js
event-dappp/README.md

### Acceptance Criteria

- [ ] No sensitive keys or tokens remain in frontend source
- [ ] Upload flow uses secure server-side authorization
- [ ] Event image upload works successfully after change
- x[ ] Security setup and rotation steps are documented

### Verification and Test Strategy

Search repository for old secret patterns and verify removal.
Run create event flow with image upload and verify success.
Verify client does not directly contain long-lived secrets.

### Dependencies or Blockers

Requires valid secure backend/serverless endpoint setup.
May require rotating previously exposed credentials.

Start by inspecting event-dappp/src/components/CreateEventPage.jsx and event-dappp/src/index.js, then search the repository for exposed secret patterns and the current IPFS upload flow. Determine how the required secure backend or serverless endpoint fits the existing architecture. Done means the client has no long-lived secrets, image upload still works, and event-dappp/README.md documents environment setup and rotation steps.

Written by the indexing model from the issue text.