[Backend] Weak default JWT secret in auth.config.ts

**Location:** `backend/src/config/auth.config.ts` (around line 6)

**Problem:**
The JWT secret falls back to a hardcoded default (`'your-secret-key-min-32-chars-change-in-production'`) when `JWT_SECRET` is not set in the environment. If this is ever deployed without the env var explicitly configured, every token can be forged by anyone who reads the source code.

**Why it matters:**
This is a critical authentication bypass risk — any environment that forgets to set `JWT_SECRET` is fully compromised.

**Suggested fix:**
- Throw on startup (fail fast) if `JWT_SECRET` is not set, instead of silently falling back to a weak default.
- Add a startup validation step (e.g. in `main.ts` or a config validation schema) that checks secret length/entropy.

**Acceptance criteria:**
- App refuses to boot without a properly configured `JWT_SECRET`.
- A test covers the failure case.

Start in backend/src/config/auth.config.ts around line 6, then inspect the startup entry point in main.ts and any existing configuration validation. Add coverage for boot failure when JWT_SECRET is absent or inadequately configured; done means the app refuses to start without a properly configured secret.

Written by the indexing model from the issue text.