feat(auth): add secure configuration and environment support

backend/hermes/app/core/config.py

@@ -2,15 +2,16 @@ from pydantic_settings import BaseSettings, SettingsConfigDict
 
 
 class Settings(BaseSettings):
+    database_url: str
+    secret_key: str
+
     app_name: str = "Hermes API"
     app_version: str = "0.1.0"
 
-    database_url: str
-
     model_config = SettingsConfigDict(
         env_file=".env",
-        case_sensitive=False
+        extra="ignore",
     )
 
 
-settings = Settings()
+settings = Settings()

backend/hermes/app/core/security.py

@@ -3,9 +3,10 @@ from datetime import UTC, datetime, timedelta
 from jose import jwt
 from pwdlib import PasswordHash
 
+from app.core.config import settings
+
 password_hash = PasswordHash.recommended()
 
-SECRET_KEY = "CHANGE_ME"
 ALGORITHM = "HS256"
 ACCESS_TOKEN_EXPIRE_MINUTES = 60
 
@@ -26,4 +27,8 @@ def create_access_token(subject: str) -> str:
         "exp": expire,
     }
 
-    return jwt.encode(payload, SECRET_KEY, algorithm=ALGORITHM)
+    return jwt.encode(
+        payload,
+        settings.secret_key,
+        algorithm=ALGORITHM,
+    )