Stop falling back to a committed edge signing secret

`EDGE_JWT_SECRET` was read as `process.env.EDGE_JWT_SECRET ?? "dev-edge-secret-change-me"`
in two places. Anything holding that string can mint an edge JWT for any
`farm_id` it likes and open `/ws/edge/v1` as that farm's gateway: enough to
feed a farm false telemetry and to receive the commands meant for its
printers. It is in a git repository, so it is not a secret.

The `??` made it worse rather than better. It only catches null and
undefined, and the committed `.env.example` ships `EDGE_JWT_SECRET=` *empty* -
so a deployment that copied the template and filled in everything else signed
its edge JWTs with the empty string and never reached the fallback at all.
That is exactly the case the fallback existed to cover.

Both reads now come from `src/auth/edge_secret.ts`, which throws at module
load if the variable is unset or empty. Same shape as `verifier.ts` and for
the same reason: a backend that boots and then fails every gateway handshake
looks like a network problem somewhere else. There is no development default
on purpose - a secret that works out of the box is a secret that reaches
production, and `openssl rand -hex 32` is a one-time cost.

Tests: the empty-string case, since that is the one the template produced,
and a grep for both shapes that reintroduce the hole - a literal passed to
`jwt()`, and a defaulted read of the variable - plus an assertion that the
variable is read in exactly one place. 60 pass.

src/auth/edge_secret.ts

@@ -0,0 +1,34 @@
+/**
+ * The HS256 secret that signs and verifies edge-gateway JWTs, read once at
+ * module load so a misconfigured deployment fails at boot rather than on the
+ * first gateway connection. Same reasoning as `verifier.ts`, and the same
+ * shape deliberately.
+ *
+ * It replaces a literal `"dev-edge-secret-change-me"` fallback that was
+ * duplicated in `routes/auth.ts` and `routes/ws/edge.ts`. Two problems with
+ * that, beyond the duplication:
+ *
+ * - The fallback is in a git repository, so it is not a secret. Anything that
+ *   knows it can mint an edge JWT for any `farm_id` it likes and open
+ *   `/ws/edge/v1` as that farm's gateway - which is enough to feed a farm
+ *   false telemetry and to receive the commands meant for its printers.
+ * - It was reached with `??`, which only catches null and undefined. The
+ *   committed `.env.example` ships `EDGE_JWT_SECRET=` *empty*, so a
+ *   deployment that copies the template and fills in everything else got an
+ *   empty-string secret and no fallback at all - the one case the fallback
+ *   was there to cover, missed.
+ *
+ * There is no development default on purpose. A secret that works out of the
+ * box is a secret that reaches production: `openssl rand -hex 32` into
+ * `.env` is a one-time cost, and unlike `SUPABASE_URL` there is nothing to
+ * look up to get it. Tests that need one set it before importing this.
+ */
+const secret = process.env.EDGE_JWT_SECRET;
+if (!secret) {
+  throw new Error(
+    "EDGE_JWT_SECRET is not set - it signs the edge JWTs that /ws/edge/v1 trusts, " +
+      "so there is no safe default. Generate one with: openssl rand -hex 32",
+  );
+}
+
+export const edgeJwtSecret = secret;

src/routes/auth.ts

@@ -5,6 +5,7 @@ import { UnauthorizedError } from "@continuum/ts-core";
 import { db } from "../db";
 import { farms } from "../db/schema";
 import { listMemberships, requireUser } from "../auth";
+import { edgeJwtSecret } from "../auth/edge_secret";
 
 const EDGE_TOKEN_TTL_SECONDS = 3600;
 
@@ -31,7 +32,7 @@ export const authRoutes = new Elysia({ prefix: "/auth" })
   .use(
     jwt({
       name: "edgeJwt",
-      secret: process.env.EDGE_JWT_SECRET ?? "dev-edge-secret-change-me",
+      secret: edgeJwtSecret,
     }),
   )
   .post(

src/routes/ws/edge.ts

@@ -10,6 +10,7 @@ import {
 import { db } from "../../db";
 import { printers } from "../../db/schema";
 import { enqueueFrameIngestionBatch } from "../../queue";
+import { edgeJwtSecret } from "../../auth/edge_secret";
 
 /**
  * Edge-gateway uplink. A continuum-proxy gateway connects here with a
@@ -217,7 +218,7 @@ export function isGatewayOnline(farmId: string): boolean {
 }
 
 export const edgeWsRoute = new Elysia()
-  .use(jwt({ name: "edgeJwt", secret: process.env.EDGE_JWT_SECRET ?? "dev-edge-secret-change-me" }))
+  .use(jwt({ name: "edgeJwt", secret: edgeJwtSecret }))
   .ws("/ws/edge/v1", {
     body: EdgeClientMessageSchema,