[Bug]: Hardcoded fallback JWT secrets in production path

[vib3withsimran]

Description

File: server/config/jwt.js

Description:

## Bug Description
 
`server/config/jwt.js` falls back to **predictable, hardcoded secrets** when env vars are missing:
 
```js
JWT_SECRET: JWT_SECRET || 'codevibe_default_secret',
REFRESH_TOKEN_SECRET: REFRESH_TOKEN_SECRET || 'codevibe_default_refresh_secret',

The process.exit(1) guard only fires when NODE_ENV === 'production' and the env vars are missing at boot. Any deployment where NODE_ENV is not set correctly (common on free-tier hosts) silently uses the public default secrets, allowing anyone to forge access tokens and impersonate any user, including admins.

type of issue: critical

Steps to Reproduce

1. Go to '...'
2. Click on '...'
3. See error

Expected Behavior

• Never fall back to a known default in any environment.
• Fail fast (crash with a clear message) whenever secrets are missing, regardless of NODE_ENV .

Actual Behavior

Environment

• OS: [e.g. Windows 11, macOS 14]
• Browser: [e.g. Chrome 124, Firefox 125]
• Node.js: [e.g. 18.17.0]
• Platform: [Local / Live at codevibeforyou.netlify.app]

Screenshots / Logs

Possible Fix (optional)

[ ] Server refuses to start without real secrets (all environments)
[ ] No codevibe_default_* secret literals remain in source

• Require JWT_SECRET / REFRESH_TOKEN_SECRET unconditionally at startup.
• Use a generated random secret only in local dev via a .env template, never a hardcoded literal.

[github-actions]

Thank you for your contribution! The maintainer will review your issue/PR shortly.

We appreciate your patience.

[vib3withsimran]

hi @JiyaBatra
can u assign me this issue?