Add one-click install script with automatic secret generation

- Create scripts/install.sh that auto-generates Ed25519 signing key,
  JWT secret, Postgres and MinIO passwords from .env.example placeholders
- Add startup validation in server to reject placeholder secrets
- Add 401 interceptor in console API client to clear stale JWT tokens
- Update README Quick Start to use ./scripts/install.sh
- Update .env.example with GENERATE_ME placeholders for all secrets

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/server/src/index.ts

@@ -43,6 +43,21 @@ const queue = new BullMQAdapter({
   port: Number(redisUrl.port) || 6379,
 });
 
+// ---------------------------------------------------------------------------
+// Validate required secrets at startup
+// ---------------------------------------------------------------------------
+
+const requiredSecrets = [
+  { name: 'JWT_SECRET', value: process.env.JWT_SECRET },
+  { name: 'ELYDORA_SIGNING_KEY', value: process.env.ELYDORA_SIGNING_KEY },
+];
+for (const { name, value } of requiredSecrets) {
+  if (!value || value.startsWith('change-me')) {
+    console.error(`FATAL: ${name} is not configured. Run ./scripts/install.sh to generate secrets.`);
+    process.exit(1);
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Build the env bindings object
 // ---------------------------------------------------------------------------