fix(security): remove hardcoded JWT secret fallback - CRITICAL

BREAKING CHANGE: Server now requires JWT_SECRET environment variable to be set

Security fixes:
- Remove hardcoded JWT secret fallback 'your-secret-key' from protectedImages.js
- Add startup validation to ensure JWT_SECRET is properly configured
- Reject insecure default values and short secrets
- Server will refuse to start without proper JWT_SECRET

This fixes a critical vulnerability where the application would use a publicly
known secret if JWT_SECRET was not set, completely compromising authentication.

Migration guide: docs/JWT_SECRET_MIGRATION.md

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/src/routes/protectedImages.js

@@ -12,7 +12,7 @@ const router = express.Router();
  * Generate a signed URL token for image access
  */
 function generateImageToken(photoId, expiresIn = 3600) {
-  const secret = process.env.JWT_SECRET || 'your-secret-key';
+  const secret = process.env.JWT_SECRET;
   const expires = Date.now() + (expiresIn * 1000);
   const data = `${photoId}:${expires}`;
   const signature = crypto.createHmac('sha256', secret).update(data).digest('hex');
@@ -24,7 +24,7 @@ function generateImageToken(photoId, expiresIn = 3600) {
  */
 function verifyImageToken(token) {
   try {
-    const secret = process.env.JWT_SECRET || 'your-secret-key';
+    const secret = process.env.JWT_SECRET;
     const [data, signature] = token.split('.');
     const decoded = Buffer.from(data, 'base64').toString();
     const [photoId, expires] = decoded.split(':');