Persist a per-install JWT signing secret instead of a compiled-in default.

Admin tokens were forgeable whenever JWT_SECRET was unset. Prefer the env var, otherwise write a random key to data/.jwt_secret.

internal/auth/jwt_test.go

@@ -4,6 +4,8 @@ import (
 	"context"
 	"net/http"
 	"net/http/httptest"
+	"os"
+	"path/filepath"
 	"testing"
 	"time"
 )
@@ -30,12 +32,53 @@ func TestJWTManager_GenerateValidate_Roundtrip(t *testing.T) {
 	}
 }
 
-func TestJWTManager_DevSecretFallback(t *testing.T) {
-	m := NewJWTManager("") // empty -> dev
+func TestJWTManager_EmptySecretRandomRoundtrip(t *testing.T) {
+	m := NewJWTManager("") // empty -> random in-memory secret
 	token, _ := m.GenerateToken(1, "a@b", "A", nil)
 	_, err := m.ValidateToken(token)
 	if err != nil {
-		t.Error("dev secret should allow roundtrip")
+		t.Error("random secret should allow roundtrip")
+	}
+	m2 := NewJWTManager("")
+	if _, err := m2.ValidateToken(token); err == nil {
+		t.Error("separate empty managers must not share a well-known secret")
+	}
+}
+
+func TestLoadOrCreateSecret_EnvWins(t *testing.T) {
+	t.Setenv("JWT_SECRET", "from-env")
+	got, err := LoadOrCreateSecret(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != "from-env" {
+		t.Fatalf("got %q", got)
+	}
+}
+
+func TestLoadOrCreateSecret_Persists(t *testing.T) {
+	t.Setenv("JWT_SECRET", "")
+	dir := t.TempDir()
+	a, err := LoadOrCreateSecret(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if a == "" {
+		t.Fatal("empty secret")
+	}
+	b, err := LoadOrCreateSecret(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if a != b {
+		t.Fatalf("secret not persisted: %q vs %q", a, b)
+	}
+	raw, err := os.ReadFile(filepath.Join(dir, ".jwt_secret"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(raw) == "" {
+		t.Fatal("secret file empty")
 	}
 }