fix: API frontend readiness, documentation, and project cleanup

.env.example

@@ -4,10 +4,11 @@
 # ============================================================
 # JWT CONFIGURATION
 # ============================================================
-# Generate with: openssl genrsa -out jwt-private.pem 2048
-# Generate public key with: openssl rsa -in jwt-private.pem -pubout -out jwt-public.pem
-JWT_PRIVATE_KEY=
-JWT_PUBLIC_KEY=
+# Shared HMAC secret — must be identical in user-service and api-gateway
+# Generate with: openssl rand -hex 32
+JWT_SECRET=your-strong-secret-min-32-chars-here
+# Optional: separate secret for refresh tokens. Falls back to JWT_SECRET if unset.
+JWT_REFRESH_SECRET=your-refresh-token-secret-here
 JWT_ACCESS_TTL=15m
 JWT_REFRESH_TTL=168h