fix(OPENFRAM-004-8): CU-86akdypzw 2 review findings in openframe-authorization-server.yml

[flamingo]

Closes 2 review findings in configs/base/openframe-authorization-server.yml.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🟢 90 high	Symmetric encryption password/salt in authorization-server config default to hardcoded literal fallback values	configs/base/openframe-authorization-server.yml:86
2	🟡 85 medium	ENCRYPTION_PASSWORD/ENCRYPTION_SALT defaults are secrets, not safe local-dev values	configs/base/openframe-authorization-server.yml:86

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 16dc4bdf-608c-4c65-84b9-63df756e4657

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akdypzw OpenFrame Kubernetes manifest hardening secondary (12 PRs)

[flamingo]

🦩 What this fix changed, finding by finding

2 finding(s) fixed in this draft — 2 explained inline on the diff.

[flamingo]

🦩 🔴 Symmetric encryption password/salt in authorization-server config default to hardcoded literal fallback values

Replaced the hardcoded literal fallback kdCJxik7VWRlG5L8jKHBeJQK5unssi7u1uHOd01b75ilr8n for ENCRYPTION_PASSWORD with an empty default (${ENCRYPTION_PASSWORD:}) in the security.encryption.password key, removing the baked-in secret material from source control as required by OPENFRAM-004-8.

🤖 Prompt for AI agents

In configs/base/openframe-authorization-server.yml around line 86, review and complete this code-review fix: Symmetric encryption password/salt in authorization-server config default to hardcoded literal fallback values.
What the draft fix changed: Replaced the hardcoded literal fallback `kdCJxik7VWRlG5L8jKHBeJQK5unssi7u1uHOd01b75ilr8n` for `ENCRYPTION_PASSWORD` with an empty default (`${ENCRYPTION_PASSWORD:}`) in the `security.encryption.password` key, removing the baked-in secret material from source control as required by OPENFRAM-004-8.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 90 high — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 ENCRYPTION_PASSWORD/ENCRYPTION_SALT defaults are secrets, not safe local-dev values

Replaced the hardcoded literal fallback 74f62c51327175b05abe1ad78030565c for ENCRYPTION_SALT with an empty default (${ENCRYPTION_SALT:}) in the security.encryption.salt key, so no reusable real cryptographic default is present in this shared base config; deployments must now supply both env vars explicitly (a startup failure/validation on empty values would need to be enforced elsewhere in the app, which is outside this config file's scope).

🤖 Prompt for AI agents

In configs/base/openframe-authorization-server.yml around line 86, review and complete this code-review fix: ENCRYPTION_PASSWORD/ENCRYPTION_SALT defaults are secrets, not safe local-dev values.
What the draft fix changed: Replaced the hardcoded literal fallback `74f62c51327175b05abe1ad78030565c` for `ENCRYPTION_SALT` with an empty default (`${ENCRYPTION_SALT:}`) in the `security.encryption.salt` key, so no reusable real cryptographic default is present in this shared base config; deployments must now supply both env vars explicitly (a startup failure/validation on empty values would need to be enforced elsewhere in the app, which is outside this config file's scope).
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 85 medium — react 👍/👎 to teach the reviewer