fix: raise RuntimeError when SESSION_SECRET_KEY is not set in setup_o…

[piyushdotcomm]

Problem

setup_oauth() in app/auth.py used a hardcoded fallback value:

secret_key=os.getenv("SESSION_SECRET_KEY", "supersecretkey")

If SESSION_SECRET_KEY was not set in the environment, the app silently
used "supersecretkey" as the session signing key. Since this value is
publicly visible in the source code, anyone could forge valid session
cookies and gain authenticated access without going through OAuth.

The app gave no warning and did not refuse to start when running with
this insecure fallback.

Fix

Removed the hardcoded fallback. The app now validates SESSION_SECRET_KEY
at startup and raises a RuntimeError with a clear message if it is missing,
preventing silent insecure deployments.

secret_key = os.getenv("SESSION_SECRET_KEY")
if not secret_key:
    raise RuntimeError(
        "SESSION_SECRET_KEY environment variable is not set. "
        "Please set a strong random secret in your .env file before starting the app."
    )
app.add_middleware(SessionMiddleware, secret_key=secret_key)

Fixes #101