Add TOKEN_SECRET to .env.example and document required auth environment variable

### Overview
The authentication system requires a `TOKEN_SECRET` environment variable for JWT signing, but it is not documented in `.env.example`. The config previously fell back to a hardcoded placeholder, which has been replaced with a startup error. Developers and deployments need to know this variable is required.

### Action Items
- [ ] Add `TOKEN_SECRET` to `backend/.env.example` with a placeholder value and comment explaining its purpose
- [ ] Verify the dev and prod deployments have `TOKEN_SECRET` set in their environment
- [ ] Update any onboarding/setup documentation that references `.env` configuration

### Resources/Instructions
- `backend/config/auth.config.js` — where the variable is consumed and validated
- `backend/middleware/auth.middleware.js` — where it's used for JWT signing