Security: Migrate away from hardcoded dev encryption fallback keys

[prem22k]

This session replaced hardcoded production encryption keys with a dev-only fallback guarded by NODE_ENV (backend/utils/encryption.js, routes/generateProjectRoutes.js, routes/github.js, routes/projectRoutes.js). Dev still uses a known string key: 'dev-only-encryption-key-123'.

Work needed:

• Generate key entropy from a securely-random source in dev (e.g. environment-injected or generated at first boot)
• Document key rotation for existing encrypted tokens (changing the key invalidates stored GitHub OAuth tokens)
• Consider decrypt-and-reencrypt migration tooling

Why: a known dev key means any seeded dev environment shares one key; a leaked dev .env exposes all token ciphertext.