Harden JWT key handling and redact secrets from command logs

[tomsmith8]

Summary

• Remove the hardcoded "some-secret" JWT fallback: an empty/blank key is now a hard error, and when no key is configured a random 48-char key is generated once per process (rotates on restart)
• Add set_jwt_key_from_config so an empty stack config value means "not configured" while a blank-but-set value still fails startup
• Redact secrets from Debug output of LoginInfo, ChangePasswordInfo, ChangeAdminInfo, ChangeUserPasswordBySuperAdminInfo, UpdateEnvRequest, and AssignSwarmNewDetails so log::info!("=> CMD: {:?}", cmd) never leaks passwords or env values (keys are logged, values replaced with [REDACTED])
• Log env variable updates as key lists only instead of full values
• Add IDOR guards: password-change commands must target the authenticated caller's own user id
• Add unit tests covering key validation, redaction, and access control

Generated with Hive