fix(config): require JWT_SECRET and untrack .env

.env was versioned with the database password and the JWT secret, and
main.rs fell back to that same hardcoded secret whenever the variable
was missing. A deployment that forgot to set it would have run with a
publicly known signing key without any warning.

The process now panics without JWT_SECRET, tests use their own secret
through cfg(test), and .env.example documents the expected shape. A
missing .env is no longer fatal, since clap already reports whatever
variable is absent.

Also point upload_dir at ./uploads: the old default was an absolute
path into a machine that no longer exists.

.env

@@ -1,3 +0,0 @@
-DATABASE_URL=postgres://agenda:!agenda123@localhost/agenda
-JWT_SECRET=ELDv7FOeXx8fTBm92UGgrGO9ElKwl15U
-PORT=3000

.env.example

@@ -0,0 +1,12 @@
+# Copie para .env e ajuste. O .env nao vai para o repositorio.
+
+DATABASE_URL=postgres://agenda:senha@localhost/agenda
+
+# Obrigatorio. Gere um valor proprio:
+#   openssl rand -base64 32
+JWT_SECRET=
+
+PORT=3000
+
+# Onde os avatares enviados sao gravados.
+UPLOAD_DIR=./uploads

.gitignore

@@ -6,3 +6,6 @@ tests/api/log.html
 tests/api/output.xml
 tests/api/report.html
 .vscode
+.env
+uploads/
+test-attachment.png

src/config.rs

@@ -5,7 +5,7 @@ pub struct Config {
     #[clap(long, env)]
     pub database_url: String,
 
-    #[clap(long, env, default_value = "/Users/alexandrepossebom/Devel/schdlr-vue/src/assets/images/avatars")]
+    #[clap(long, env, default_value = "./uploads")]
     pub upload_dir: String,
 
     #[clap(long, env, default_value = "3000")]
@@ -14,7 +14,9 @@ pub struct Config {
 
 impl Config {
     pub fn from_env() -> Self {
-        dotenv::dotenv().expect("Unable to load environment variables from .env file");
+        // O .env nao esta versionado: se nao existir, as variaveis vem do ambiente
+        // e o proprio clap reclama do que estiver faltando.
+        let _ = dotenv::dotenv();
         Self::parse()
     }
 

src/main.rs

@@ -41,7 +41,10 @@ mod tests;
 mod utils;
 
 static KEYS: Lazy<models::employee::Keys> = Lazy::new(|| {
-    let secret = std::env::var("JWT_SECRET").unwrap_or_else(|_| "ELDv7FOeXx8fTBm92UGgrGO9ElKwl15U".to_owned());
+    #[cfg(test)]
+    let secret = "secret-only-for-tests".to_owned();
+    #[cfg(not(test))]
+    let secret = std::env::var("JWT_SECRET").expect("JWT_SECRET must be set");
     models::employee::Keys::new(secret.as_bytes())
 });