[SEC-13] Remove hardcoded JWT_SECRET default and validate at startup in all environments

[grantfox-oss]

Problem

In micopay/backend/src/config.ts:124, the JWT_SECRET has a hardcoded default:

jwtSecret: process.env.JWT_SECRET || 'dev_jwt_secret'

The validateConfig() function (line 220) only runs when isProduction is true. If NODE_ENV is accidentally unset or misspelled, isProduction evaluates to false, startup validation is skipped, and the entire system runs on a publicly known signing key.

Additionally, docker-compose.yml:19 sets:

JWT_SECRET=${JWT_SECRET:-change_me_in_production}

This means anyone who runs docker-compose up without setting JWT_SECRET gets a well-known, weak signing key.

Impact

• Anyone can forge valid JWT tokens
• Full account takeover possible
• Authentication system becomes meaningless

Proposed Fix

1. Remove the hardcoded default: jwtSecret: process.env.JWT_SECRET || ''
2. Make validateConfig() always require a non-empty JWT_SECRET regardless of environment
3. Remove the default from docker-compose.yml — make it required with no fallback
4. Add a minimum length check (32 chars) in all environments

Files to modify

• micopay/backend/src/config.ts (lines 124, 204-263)
• docker-compose.yml (line 19)

Acceptance Criteria

• No hardcoded JWT_SECRET defaults anywhere in codebase
• Server refuses to start without JWT_SECRET set
• Minimum length validation (32 chars) in all environments
• docker-compose.yml requires JWT_SECRET with no fallback