feat(audit): fail closed without signing secret

[P4ST4S]

Summary

Make audit signing fail closed: when audit.sign is enabled, configuration loading now requires a non-blank signing secret before any store, listener, dashboard, metrics server, or upstream process is initialized.

Introduce MCP_AUDIT_SIGNING_SECRET as the preferred environment variable while preserving AUDIT_SECRET compatibility.

Context

Closes #67.

Stacked on #75 and #74.

Approach

• resolve signing secret precedence during config loading
• prefer MCP_AUDIT_SIGNING_SECRET, then legacy AUDIT_SECRET, then audit.secret
• treat an explicitly empty preferred environment value as an override and fail closed
• reject missing and whitespace-only secrets with a clear configuration error
• retain sign=false behavior without requiring any secret
• warn, without failing, when a configured secret is shorter than 32 bytes
• update runtime examples and installation troubleshooting

Test plan

• go test -race ./cmd/mcp-audit ./internal/audit/... ./internal/proxy/...
• go test -race ./...
• go build ./...
• go vet ./...
• Manual binary startup without either secret environment variable: exits non-zero before startup with audit signing is enabled but no signing secret is configured

All automated commands pass and the negative startup check returns the expected configuration failure.

Stability impact

This intentionally changes the existing audit.sign: true misconfiguration from silently unsigned output to a startup failure. audit.sign: false remains unchanged.

The new environment variable is additive. The existing AUDIT_SECRET environment variable and audit.secret config key remain supported.

Notes for reviewer

Minimum secret length is warning-only in v1.2.0 to avoid rejecting existing non-empty secrets. Missing and whitespace-only values are hard failures.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 66.66667% with 4 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
cmd/mcp-audit/main.go	66.66%	4 Missing ⚠️

📢 Thoughts on this report? Let us know!