Stop falling back to a committed edge signing secret

`EDGE_JWT_SECRET` was read as `process.env.EDGE_JWT_SECRET ?? "dev-edge-secret-change-me"`
in two places. Anything holding that string can mint an edge JWT for any
`farm_id` it likes and open `/ws/edge/v1` as that farm's gateway: enough to
feed a farm false telemetry and to receive the commands meant for its
printers. It is in a git repository, so it is not a secret.

The `??` made it worse rather than better. It only catches null and
undefined, and the committed `.env.example` ships `EDGE_JWT_SECRET=` *empty* -
so a deployment that copied the template and filled in everything else signed
its edge JWTs with the empty string and never reached the fallback at all.
That is exactly the case the fallback existed to cover.

Both reads now come from `src/auth/edge_secret.ts`, which throws at module
load if the variable is unset or empty. Same shape as `verifier.ts` and for
the same reason: a backend that boots and then fails every gateway handshake
looks like a network problem somewhere else. There is no development default
on purpose - a secret that works out of the box is a secret that reaches
production, and `openssl rand -hex 32` is a one-time cost.

Tests: the empty-string case, since that is the one the template produced,
and a grep for both shapes that reintroduce the hole - a literal passed to
`jwt()`, and a defaulted read of the variable - plus an assertion that the
variable is read in exactly one place. 60 pass.

tests/authz.test.ts

@@ -130,4 +130,43 @@ describe("configuration", () => {
     expect(await proc.exited).not.toBe(0);
     expect(await new Response(proc.stderr).text()).toContain("SUPABASE_URL");
   });
+
+  // An empty value, not an unset one, because that is what the committed
+  // `.env.example` ships: the old `process.env.EDGE_JWT_SECRET ?? "dev-..."`
+  // only caught null and undefined, so copying the template and filling in
+  // everything else left the edge JWTs signed with "". Anything that knew
+  // that - or the committed fallback literal - could mint a token for any
+  // farm_id and open /ws/edge/v1 as that farm's gateway.
+  test("the process refuses to start with an empty EDGE_JWT_SECRET", async () => {
+    const proc = Bun.spawn(["bun", "-e", "await import('./src/auth/edge_secret.ts')"], {
+      cwd: import.meta.dir + "/..",
+      env: { ...process.env, EDGE_JWT_SECRET: "" },
+      stderr: "pipe",
+      stdout: "pipe",
+    });
+    expect(await proc.exited).not.toBe(0);
+    expect(await new Response(proc.stderr).text()).toContain("EDGE_JWT_SECRET");
+  });
+
+  test("no route holds a hardcoded signing secret", async () => {
+    // The old fallback was duplicated across two routes, and a third copy
+    // would be just as exploitable as the first two, so this greps the tree
+    // rather than the files that happened to have it. Two shapes, because
+    // either one reintroduces the hole: a literal passed to `jwt()`, and a
+    // defaulted read of the variable (`?? "..."` / `|| "..."`), which is
+    // what let an empty `EDGE_JWT_SECRET` through.
+    const grep = async (pattern: string) => {
+      const proc = Bun.spawn(["grep", "-rnE", pattern, "src"], {
+        cwd: import.meta.dir + "/..",
+        stdout: "pipe",
+      });
+      return new Response(proc.stdout).text();
+    };
+    expect(await grep('secret:\\s*["\'`]')).toBe("");
+    expect(await grep('EDGE_JWT_SECRET\\s*(\\?\\?|\\|\\|)')).toBe("");
+    // And the variable is read in exactly one place, so there is only ever
+    // one line to get right.
+    expect(await grep("process\\.env\\.EDGE_JWT_SECRET")).toContain("src/auth/edge_secret.ts");
+    expect((await grep("process\\.env\\.EDGE_JWT_SECRET")).trim().split("\n")).toHaveLength(1);
+  });
 });