For a public static site, a browser-side TMDB key can be visible to visitors. Do not put private secrets here.
This first version uses localStorage for manual movies and banners, so changes are stored on the same browser/device. To make admin changes sync to every visitor, connect Firebase and move these collections to Firestore/Realtime Database.