Handle secrets and other deployment configuration

[eddies]

At present, app.yaml includes hard-coded values for the database name, user, password, etc.

We should support securely fetching these values within the GCP environment using something like KMS, datastore or project metadata.

[eddies]

See for example:

• https://stackoverflow.com/questions/6501234/gae-best-practices-for-storing-secret-keys
• https://stackoverflow.com/questions/46939453/is-there-a-way-to-import-environment-variables-in-google-app-engines-app-yaml
• https://medium.com/google-cloud/service-discovery-and-configuration-on-google-cloud-platform-spoiler-it-s-built-in-c741eef6fec2