fix(security): validate credentials and prevent weak defaults

[seapagan]

Summary

Replace hardcoded default credentials with sentinel values and add comprehensive validation to prevent insecure deployments.

Changes

• ✅ Replace weak defaults in settings.py with CHANGE_ME_IN_ENV_FILE sentinel values
• ✅ Add validators for SECRET_KEY, DB_PASSWORD, and DB_USER
• ✅ Enforce minimum 32-character length for SECRET_KEY
• ✅ Detect and reject known weak passwords and default values
• ✅ Update .env.example with clear instructions and secure placeholders
• ✅ Add comprehensive test coverage for all validators (100% coverage)
• ✅ Extract MIN_SECRET_KEY_LENGTH constant to avoid magic numbers
• ✅ Combine test files for better organization

Security Impact

🔒 Prevents accidental production deployment with default credentials

• Application will fail to start if weak/default credentials are detected
• Forces proper configuration before application startup
• Provides clear error messages with remediation steps

Testing

• ✅ 22 new/updated tests for all validators
• ✅ 100% code coverage for app/config/settings.py
• ✅ All 504 tests passing
• ✅ Ruff linting clean
• ✅ MyPy type checking passing

Example Error Messages

Users will see helpful error messages like:

======================================================================
SECURITY ERROR: SECRET_KEY is using a weak/default value!
======================================================================
Generate a strong key with one of these commands:
  openssl rand -hex 32
  python -c 'import secrets; print(secrets.token_hex(32))'

Then add it to your .env file:
  SECRET_KEY=your_generated_key_here
======================================================================

[codacy-production]

Coverage summary from Codacy

See diff coverage on Codacy

Coverage variation	Diff coverage
✅ +0.00% (target: -1.00%)	✅ 100.00%

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (420aefc)	1709	1709	100.00%
Head commit (1982dbb)	1736 (+27)	1736 (+27)	100.00% (+0.00%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#793)	35	35	100.00%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

See your quality gate settings    Change summary preferences