Production mode shouldn't have a default JWT signing secret

Details

Currently when generating User API tokens, they are signed using Jokens default signer, which is signed with a string of secret.

This means that tokens can be forged.

Fortunately we verify that the token exists in the database, and we use the jti claim making it's all but impossible to produce a token with the same signature.

However if at some point we verify tokens without querying the database, then this would be a security vulnerability.

Implementation notes

At the very least we need to have prod.exs set the Joken default signer to nil, and then use an environment variable to set the signing secret.

In order to avoid issues with defaults, perhaps adopting the same pattern as the worker tokens - where the signer is not defined in config/ and rather inside Lightning.Config.

Release notes

User acceptance criteria

The application should fail to start in production mode without a API_TOKEN_SIGNING_SECRET env var.

Start by reading prod.exs and Lightning.Config, then compare how the worker-token signer is configured. Check the production startup path with and without API_TOKEN_SIGNING_SECRET. Done means production refuses to start without the environment variable and uses the provided secret when it is present.