feat(security): harden for production deployment

- auth: first registered user becomes superadmin (active immediately)
- entrypoint: no longer seeds demo data in prod (opt-in via RUN_SEED=1)
- config: refuse to boot in prod with weak/placeholder SECRET_KEY (<32 chars)
- main: restrict CORS to FRONTEND_URL only in prod (localhost dev-only)
- seed_db: block prod seeding, read passwords from env, stop printing them
- login: remove demo account credentials from UI

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/app/core/config.py

@@ -1,7 +1,19 @@
 """Application configuration."""
 from typing import List
+from pydantic import model_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
+DEFAULT_SECRET_KEY = "your-secret-key-change-in-production"
+
+# Known weak/placeholder secrets that must never reach production.
+WEAK_SECRET_KEYS = {
+    DEFAULT_SECRET_KEY,
+    "change-me-in-production",  # docker-compose fallback
+    "change-me",
+    "secret",
+    "changeme",
+}
+
 
 class Settings(BaseSettings):
     """Application settings."""
@@ -20,7 +32,7 @@ class Settings(BaseSettings):
     database_url: str = "sqlite:///./space_booking.db"
 
     # JWT
-    secret_key: str = "your-secret-key-change-in-production"
+    secret_key: str = DEFAULT_SECRET_KEY
     algorithm: str = "HS256"
     access_token_expire_minutes: int = 1440  # 24 hours
 
@@ -44,5 +56,17 @@ class Settings(BaseSettings):
         "https://www.googleapis.com/auth/calendar.events"
     ]
 
+    @model_validator(mode="after")
+    def _enforce_production_secrets(self) -> "Settings":
+        """Refuse to boot in production with a weak SECRET_KEY."""
+        if not self.debug:
+            if self.secret_key in WEAK_SECRET_KEYS or len(self.secret_key) < 32:
+                raise ValueError(
+                    "SECRET_KEY is weak or a placeholder. Set a strong, random value "
+                    "(>= 32 chars) before running in production (DEBUG=false). "
+                    "Generate one with: python -c \"import secrets; print(secrets.token_hex(32))\""
+                )
+        return self
+
 
 settings = Settings()