fix(security): reject unsafe production credentials

[legendtkl]

What changed

• add TOKENHUB_BOOTSTRAP_ADMIN_PASSWORD and use it when creating the initial administrator
• validate credentials before opening the database or starting the HTTP server
• reject placeholder, known default, or short admin tokens, secret keys, and bootstrap passwords in every non-development environment
• retain the existing local-development defaults for dev, development, local, and test
• pass the settings through start.sh and Docker Compose
• update English, Chinese, and Japanese deployment documentation

Why

Production Compose currently exposes known placeholder tokens and a hard-coded admin123456 password unless operators remember to replace them. The backend also ignores TOKENHUB_ENV, so there is no runtime safety net.

Impact

Production and staging deployments now fail fast with the names of unsafe variables. Existing development workflows continue to work without extra setup. Operators choose the initial administrator password explicitly before first startup.

Validation

• tests for insecure production, secure production, development defaults, and configured bootstrap authentication
• go vet ./...
• full backend suite reaches only the two pre-existing import/SMTP failures addressed by test(import): cover reset emails with fake SMTP #5
• git diff --check

[Copilot]

Pull request overview

This PR introduces a safer bootstrap and startup path by adding a dedicated TOKENHUB_BOOTSTRAP_ADMIN_PASSWORD, wiring TOKENHUB_ENV through runtime entrypoints, and enforcing credential strength checks for non-development environments before the backend opens the database or starts serving traffic.

Changes:

• Add TOKENHUB_BOOTSTRAP_ADMIN_PASSWORD and thread config through seeding/bootstrap paths so the initial admin password is configurable.
• Add Config.ValidateForStartup() and call it on startup to reject placeholder/weak secrets outside dev/local/test.
• Propagate new env vars through start.sh and Docker Compose, and update EN/zh-CN/ja deployment docs accordingly.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
start.sh	Adds TOKENHUB_ENV, TOKENHUB_BOOTSTRAP_ADMIN_PASSWORD, and TOKENHUB_SECRET_KEY defaults and passes them to the backend process.
README.md	Updates quickstart guidance to replace placeholders and documents the new bootstrap password behavior.
README.zh-CN.md	Same as README.md for zh-CN.
README.ja.md	Same as README.md for ja.
docs/deployment.md	Documents the new bootstrap password variable and the non-dev startup validation behavior.
docs/zh-CN/deployment.md	Same as docs/deployment.md for zh-CN.
docs/ja/deployment.md	Same as docs/deployment.md for ja.
deploy/docker-compose.yml	Passes TOKENHUB_ENV and the new bootstrap password into the backend container environment.
deploy/.env.example	Adds TOKENHUB_BOOTSTRAP_ADMIN_PASSWORD placeholder to the deployment env template.
backend/internal/server/seed.go	Introduces *WithConfig seeding/bootstrap functions and uses configured bootstrap password.
backend/internal/server/http_test.go	Adds a regression test ensuring the configured bootstrap password is used instead of the hard-coded default.
backend/internal/server/config.go	Extends config with environment + bootstrap password and adds startup validation for non-dev environments.
backend/internal/server/config_test.go	Adds tests covering production rejection, production acceptance, and retaining dev defaults.
backend/cmd/tokenhub/main.go	Validates config before opening the store or starting the HTTP server; uses *WithConfig seeding/bootstrap.
backend/.env.example	Adds dev defaults for TOKENHUB_BOOTSTRAP_ADMIN_PASSWORD and TOKENHUB_SECRET_KEY.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 2 comments.