fix(backend): graceful shutdown and strict JWT/Redis env vars

[Cedarich]

Summary

Implements graceful shutdown for the Actix-Web server and removes unsafe hardcoded fallbacks for JWT and Redis configuration.

Changes

BE-26 — Graceful shutdown (backend/modules/api/src/server.rs)

• Install SIGTERM / SIGINT handlers via tokio::signal::unix
• On signal, call ServerHandle::stop(true) so in-flight requests and WebSocket connections complete and the worker thread pool drains
• Documented from backend/src/main.rs

BE-27 — Strict secrets (backend/modules/security/src/jwt.rs, server.rs)

• Add JwtService::from_env() requiring JWT_SECRET or JWT_SECRET_KEY (no fallback; panics on empty / known insecure defaults)
• Require REDIS_URL via std::env::var(...).expect(...) (no localhost default)
• Update .env.example to mark both as required

Acceptance criteria

• SIGTERM/SIGINT trigger graceful drain of connections and workers
• Missing JWT_SECRET / JWT_SECRET_KEY crashes on startup
• Missing REDIS_URL crashes on startup
• No hardcoded JWT or Redis fallbacks remain

Closes #934
Closes #935
Closes #932

[drips-wave]

@Cedarich Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits