fix(api): enforce JWT secret and remove hardcoded fallbacks

[Spycall]

Enforce a required JWT_SECRET, remove hardcoded dev fallbacks, and add a shared JWT config that generates a clearly warned, random secret only in development.

Closes #137

[Xhristin3]

Hey @Spycall \u2014 solid security fix. Centralizing JWT config, dropping the hardcoded fallbacks, and auto-generating a dev secret with a warning lines up precisely with what #137 called for. Closes #137 cleanly. Merged, thanks for locking this down! \ud83d\udd10