More production clearances

apps/edr-passenger-api/.env.example

@@ -3,6 +3,7 @@ NODE_ENV=development
 PORT=4000
 
 # Database (Prisma) — owns the `passenger` schema in edr_database
+# Production: append ?sslmode=require&connection_limit=10&pool_timeout=20 to enforce SSL and connection pooling
 DATABASE_URL=postgresql://edr:edr_secret@localhost:5432/edr_database?schema=passenger
 
 # Database (TypeORM / @tria-plc IAM) — shared `iam` schema in the SAME edr_database.
@@ -32,14 +33,14 @@ FRONTEND_URL=http://localhost:5174
 BACK_OFFICE_URL=http://localhost:5184
 
 # JWT (legacy passenger auth — being replaced by IAM)
-JWT_SECRET=edr-platform-secret-change-in-production
+# REQUIRED in production — use a random 32+ character string (e.g. openssl rand -hex 32)
+JWT_SECRET=<change-me-min-32-chars>
 JWT_EXPIRES_IN=7d
 
-# @tria-plc IAM token contract — the package's JwtGuard/verifyToken + AuthService sign/verify with
-# these. MUST match the IAM issuer's secret in shared deployments. (Expiry strings use jsonwebtoken/ms.)
-JWT_ACCESS_TOKEN_SECRET=dev-iam-access-secret-change-me
+# @tria-plc IAM token contract — REQUIRED in production. MUST match the IAM issuer's secret.
+JWT_ACCESS_TOKEN_SECRET=<change-me-min-32-chars>
 JWT_ACCESS_TOKEN_EXPIRES=1h
-JWT_REFRESH_TOKEN_SECRET=dev-iam-refresh-secret-change-me
+JWT_REFRESH_TOKEN_SECRET=<change-me-min-32-chars>
 JWT_REFRESH_TOKEN_EXPIRES=7d
 
 # SendGrid
@@ -157,7 +158,7 @@ FAYDA_ACR_VALUES=mosip:idp:acr:generated-code
 FAYDA_CLAIMS_LOCALES=en am
 FAYDA_SESSION_TTL_MINUTES=10
 
-GITHUB_PACKAGE_TOKEN=
+GITHUB_PACKAGE_TOKEN=<your-github-packages-token>
 
 # --- Notification broker (RabbitMQ) -----------------------------------------------------------------
 # Set RABBITMQ_ENABLED=false to skip connection entirely (dev without a local broker).