Refactor installation and runner scripts for enhanced usability and security

- Updated the installation script to clarify that production wrappers do not include fixed test secrets, improving user guidance for local testing.
- Modified the jiggablend-manager and jiggablend-runner scripts to remove fixed test configurations, emphasizing the use of local test credentials via `make init-test`.
- Enhanced error handling in the runner script to ensure that an API key is provided, improving security and user feedback.
- Added new flags and options for the runner, including sandboxing capabilities and GPU ray tracing control, enhancing flexibility for users.
- Improved README documentation to reflect changes in usage and configuration, ensuring users have clear instructions for setup and execution.

internal/config/config.go

@@ -94,6 +94,9 @@ func (c *Config) InitializeFromEnv() error {
 
 // Get retrieves a config value from the database
 func (c *Config) Get(key string) (string, error) {
+	if c == nil || c.db == nil {
+		return "", nil
+	}
 	var value string
 	err := c.db.With(func(conn *sql.DB) error {
 		return conn.QueryRow("SELECT value FROM settings WHERE key = ?", key).Scan(&value)
@@ -300,8 +303,16 @@ func (c *Config) FixedAPIKey() string {
 	return c.GetWithDefault(KeyFixedAPIKey, "")
 }
 
-// IsProductionMode returns whether production mode is enabled
+// IsProductionMode returns whether production mode is enabled.
+// True if PRODUCTION=true env is set OR DB setting production_mode is true.
+// This is the single source of truth for Secure cookies, CORS, rate limits, and WS origin.
 func (c *Config) IsProductionMode() bool {
+	if os.Getenv("PRODUCTION") == "true" {
+		return true
+	}
+	if c == nil || c.db == nil {
+		return false
+	}
 	return c.GetBoolWithDefault(KeyProductionMode, false)
 }