[CRITICAL][KYC] Remove the fallback signing key from document access tokens

[Obiajulu-gif]

Summary

KYC signed URLs fall back to a public constant if all preferred secrets are absent. Any attacker who knows the source can forge document tokens in a misconfigured deployment.

Repository evidence

• lib/security/kyc-signed-urls.ts resolves JWT_SECRET, then AUTH_SESSION_SECRET, then KYC_DOCUMENT_ENCRYPTION_KEY, then the literal fallback-signing-key.
• The resulting HMAC authorizes /api/kyc-documents/:id access.

Scope

• Require a dedicated document-token signing key with minimum entropy in production.
• Separate signing-key rotation from encryption keys and retain explicit verification key IDs.
• Fail startup/preflight instead of issuing tokens under a fallback.

Acceptance criteria

• No constant or unrelated encryption key is used for document-token signing.
• Misconfigured production cannot issue or verify signed document URLs.
• Rotation preserves only the intended overlap window.

Tests

• Missing/weak-key production tests and two-version rotation tests.
• Forgery regression using the former fallback literal.

Non-goals

• Changing document encryption format.

[BigDella]

i will love to work on this issue

[grantfox-oss]

🦊 GrantFox — @BigDella has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #173)
2. Your PR will be reviewed by the Chainmove maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Third Campaign campaign!

@BigDella's PR #206 was approved and merged by @Obiajulu-gif.

🏆 @BigDella: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (446 total points). Track your full progress on GrantFox.

👏 Great work, @BigDella! Keep contributing to Chainmove.