[Gateway] Fail Startup if JWT_SECRET Equals Default Value

[ScriptedBro]

Migrated from DelegoLabs/Delego#437.
This issue belongs to the backend repository after the monorepo split.

---

Type
Task

Area
Backend / Gateway

Complexity
Trivial

Problem
apps/backend/gateway/src/auth/authService.ts:8 defaults JWT_SECRET to "change-me-in-production". If the env var is not set in production, the gateway silently uses a known secret, allowing token forgery.

Implementation Scope

• apps/backend/gateway/src/auth/authService.ts

Functions to Implement

const JWT_SECRET = process.env.JWT_SECRET;
if (!JWT_SECRET || JWT_SECRET === 'change-me-in-production') {
  if (process.env.NODE_ENV === 'production') {
    throw new Error('JWT_SECRET must be set in production');
  }
  console.warn('WARNING: Using default JWT_SECRET');
}

Tests

• Unit test: throws in production mode with default secret.
• Unit test: warns but allows in development mode.

Acceptance Criteria

• Gateway fails to start in production if JWT_SECRET is default.
• Development mode shows a warning.

Verification

• pnpm test passes.
• pnpm build completes.