Remove Firebase API key from test HTML file

[aram356]

Problem

A Firebase API key is hardcoded in crates/common/src/html_processor.test.html (line 59), embedded in a Firebase config JSON blob.

It was introduced in commit c79068c and is present on main and all derivative branches.

Recommended actions

1. Remove the key from the test file (replace with a placeholder)
2. Consider history scrubbing with git filter-repo or BFG Repo Cleaner after the fix merges

Risk assessment

Firebase API keys are client-side identifiable and restricted by Firebase Security Rules / API restrictions, so the immediate risk is lower than a leaked server-side secret. However, best practice is to remove and rotate.