fix: Remove unused SESSION_SECRET from entire codebase

[jdutton]

Summary

Removes SESSION_SECRET configuration that was defined but never actually used anywhere in the codebase. This cleans up technical debt that suggested cookie-based session management when the project actually uses header-based session tracking.

Problem

SESSION_SECRET was defined in configuration, templates, and documentation but never consumed by any code:

• ❌ No express-session or cookie-parser packages
• ❌ No cookie signing operations
• ❌ No cryptographic use of the secret
• ✅ Sessions tracked via mcp-session-id HTTP header instead
• ✅ OAuth uses standard Bearer tokens

This created confusion about what security features existed and added unnecessary configuration burden.

Changes

Source Code (5 files)

• Remove SessionSecretSchema from packages/config/src/base-config.ts
• Remove SESSION_SECRET from environment configuration
• Remove sessionSecret from all HTTP server interfaces and types
• Remove sessionSecret parameter from transport factory

Tests (15 files)

• Remove SESSION_SECRET assertions from config tests
• Remove sessionSecret from all test mocks and fixtures
• All tests continue to pass

Documentation (4 files)

• Remove SESSION_SECRET from API documentation
• Remove from production checklists
• Remove from deployment guides
• Remove from OAuth setup instructions

Templates & Config (2 files)

• Remove from scaffolding templates (.hbs files)
• Remove from .env examples

Impact

• 22 files modified
• 82 deletions, 7 insertions
• Zero functional changes - SESSION_SECRET was never used
• No breaking changes - removing unused configuration

Testing

✅ All validation passed:

• TypeScript compilation
• ESLint (zero errors)
• Unit tests (26.5s)
• Integration tests (13.9s)
• System tests - STDIO (10.3s)
• System tests - HTTP (17s)
• Headless browser tests (67s)
• OpenAPI validation
• Security scanning (gitleaks)

Verification

Thoroughly searched entire codebase for all variations:

• SESSION_SECRET
• sessionSecret
• session-secret
• session_secret

Result: Zero references remain

Rationale

Keeping unused configuration:

• ❌ Creates confusion about security features
• ❌ Suggests functionality that doesn't exist
• ❌ Adds maintenance burden
• ❌ Misleads users about required setup

Removing it:

• ✅ Clarifies actual session management approach
• ✅ Reduces configuration complexity
• ✅ Eliminates technical debt
• ✅ Prevents misleading documentation

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud