security: database credentials hardcoded across multiple backend files

[kazi716]

Problem

Database credentials (host, user, password, database name) are
hardcoded directly in multiple backend files:

• Backend/connection.php
• Backend/login.php
• Backend/signup.php
• Backend/add_attendee.php

This means:

• If the repo is ever made public with real credentials, they get exposed
• Changing the database password requires editing every file separately
• No .env protection

Suggested Fix

• Create a single .env.example file for credential template
• Update connection.php to read from environment variables
• Make all other backend files use connection.php instead of
  hardcoding credentials separately
• Add .env to .gitignore

Impact

Low risk currently (credentials are localhost defaults), but bad
practice that could cause real damage if deployed to production.

Would you like me to submit a PR with this fix?