[Wallet] Fail Startup if Master Secret Equals Default Value

[ScriptedBro]

Migrated from DelegoLabs/Delego#438.
This issue belongs to the backend repository after the monorepo split.

---

Type
Task

Area
Backend / Wallet

Complexity
Trivial

Problem
apps/backend/wallet/src/vault.ts:31 defaults the master secret to "default-dev-wallet-master-secret-key-32-chars". If the env var is not set in production, the wallet uses a known secret key, allowing fund theft.

Implementation Scope

• apps/backend/wallet/src/vault.ts

Functions to Implement

const masterSecret = process.env.WALLET_MASTER_SECRET;
if (!masterSecret || masterSecret === 'default-dev-wallet-master-secret-key-32-chars') {
  if (process.env.NODE_ENV === 'production') {
    throw new Error('WALLET_MASTER_SECRET must be set in production');
  }
  console.warn('WARNING: Using default wallet master secret');
}

Tests

• Unit test: throws in production mode with default secret.
• Unit test: warns but allows in development mode.

Acceptance Criteria

• Wallet fails to start in production if secret is default.
• Development mode shows a warning.

Verification

• pnpm test passes.
• pnpm build completes.