fix: replace hardcoded credentials with env var functions (CWE-798)

[saaa99999999]

The easy_note demo has two hardcoded credentials in its constants file: a JWT signing key and a MySQL DSN with username and password.

What was there

easy_note/pkg/consts/consts.go:21,28:

const (
    SecretKey       = "secret key"
    MySQLDefaultDSN = "gorm:gorm@tcp(localhost:3306)/gorm?charset=utf8&parseTime=True&loc=Local"
)

The JWT signing key "secret key" is used in cmd/api/mw/jwt.go:

Key: []byte(consts.SecretKey),

The DSN "gorm:gorm@tcp(...)" exposes the database username and password. Anyone reading the public repo can:

1. Forge JWT tokens with "secret key" and authenticate as any user
2. Connect to the MySQL database with gorm:gorm credentials

What changed

Replaced constants with functions that read from env vars, exiting cleanly if not set:

func SecretKey() string {
    key := os.Getenv("JWT_SECRET_KEY")
    if key == "" {
        fmt.Fprintf(os.Stderr, "fatal: JWT_SECRET_KEY is not set. Generate one with: openssl rand -base64 32
")
        os.Exit(1)
    }
    return key
}

func MySQLDSN() string {
    dsn := os.Getenv("DB_DSN")
    if dsn == "" {
        fmt.Fprintf(os.Stderr, "fatal: DB_DSN is not set
")
        os.Exit(1)
    }
    return dsn
}

Call site updated from consts.SecretKey to consts.SecretKey().

---

CWE-798

[CLAassistant]

All committers have signed the CLA.