api-gateway JWT secret falls back to a dev value in env

[therealjhay]

ProblemThe gateway defaults the JWT secret to a known development string when unset; in a misconfigured prod it silently uses the known secret.

1. Default known secret.
2. No startup guard for prod.
3. Forged tokens possible.

Solution

• Fail startup when the JWT secret is missing or the default in prod.
• Add a secret-strength check.
• Test the guard.

Acceptance Criteria

• Prod refuses to boot with a weak/default secret.
• Dev still works.
• pnpm --filter api-gateway build passes.

Note for Contributors: Write a clear PR description. Show the prod boot guard.

[Preciousuche]

I’d like to take on issue #563: “api-gateway JWT secret falls back to a dev value in env.”
I’ll investigate how the JWT secret is loaded and ensure the API gateway does not silently fall back to an insecure development/default value. I’ll implement a secure configuration approach, add appropriate validation and tests, and verify that the change does not break existing authentication flows.
I can complete this within 24–36 hours, including implementation, testing, and submitting the changes for review.

[grantfox-oss]

🦊 GrantFox — @Preciousuche has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #563)
2. Your PR will be reviewed by the Betta-Pay maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Third Campaign campaign!

@Preciousuche's PR #582 was approved and merged by @therealjhay.

🏆 @Preciousuche: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (627 total points). Track your full progress on GrantFox.

👏 Great work, @Preciousuche! Keep contributing to Betta-Pay.