[Security] Enforce session-secret length/entropy at boot; support rotation

[mindsers]

Summary

The session secret is only presence-validated at boot — no length/entropy check and no rotation support. .env.example ships a weak placeholder (change-me-with-a-real-secret-key), which a careless deployment could keep.

Remediation

• Enforce a minimum length/entropy for the session secret at boot; refuse to start on the placeholder value in production.
• Support a secrets array ([current, ...previous]) to enable rotation without invalidating all sessions at once.

Severity

Low / Info.

---

Source: internal security review (commit 0360e87, 2026-07-21).