Use `.env` where appropriate

[thehabes]

References to https://three.t-pen.org, client id and client secret are hard coded or file constants instead of .env files. For example, tpen_public_auth.js and tpen_private_auth.js don't even import dotenv but they could.