🔐 Fix: Remove hardcoded development secrets [#6]

[Jerrycyborg]

Summary

Implements fix for Issue #6 - removes hardcoded development secrets that could be exploited in production.

Changes

1. New utility: src/utils/secrets.ts

   • Added requireSecretInProduction() function
   • Validates secrets are provided in production environments
   • Falls back to dev defaults only when NODE_ENV !== 'production'

2. Updated: src/security.ts

   • JobTokenManager constructor uses utility for EDGEMESH_JOB_TOKEN_SECRET
   • NodeJwtManager constructor uses utility for EDGEMESH_NODE_JWT_SECRET
   • NodeTrustManager constructor uses utility for EDGEMESH_BOOTSTRAP_SECRET

3. Updated: src/control-plane.ts

   • Added import for requireSecretInProduction
   • adminSecret initialization uses utility for EDGEMESH_ADMIN_SECRET

Behavior

• Development: Works as before with sensible defaults
• Production: Throws descriptive error if required secrets are missing

  Error: EDGEMESH_ADMIN_SECRET must be set in production. 
  Set the environment variable or NODE_ENV to non-production for development.
  

Testing

• Existing tests should pass (dev defaults still work)
• Production deployments will fail-fast if secrets not configured
• Can test locally by setting NODE_ENV=production without secrets

Closes

• Fixes 🔴 CRITICAL: Remove hardcoded development secrets in production code #6

Next Steps

After merging, update deployment documentation to highlight required environment variables for production.