security: fix C3, C1 and H1

C3 - config.yml contains credentials, remove from git tracking:
  - Add backend/config.yml to .gitignore
  - git rm --cached to untrack it
  - Add backend/config.yml.example with instructions

C1 - SECRET_KEY must come from .env, no unsafe default:
  - Remove hardcoded "change_me_in_production" default from config.py
  - App now fails to start if SECRET_KEY is not set (pydantic required field)
  - Generate real random key in backend/.env (gitignored)
  - Add backend/.env.example for new contributors

H1 - WebSocket /ws/status was unauthenticated:
  - Backend: require ?token= query param, validate via decode_token(),
    close with code 1008 (Policy Violation) if missing or invalid
  - Frontend: append ?token=<jwt> to WebSocket URL

backend/app/api/routes/status.py

@@ -2,6 +2,8 @@ import json
 
 from fastapi import APIRouter, WebSocket, WebSocketDisconnect
 
+from app.core.security import decode_token
+
 router = APIRouter()
 
 # Active WebSocket connections
@@ -9,7 +11,10 @@ _connections: list[WebSocket] = []
 
 
 @router.websocket("/ws/status")
-async def ws_status(websocket: WebSocket) -> None:
+async def ws_status(websocket: WebSocket, token: str | None = None) -> None:
+    if not token or not decode_token(token):
+        await websocket.close(code=1008)  # Policy Violation
+        return
     await websocket.accept()
     _connections.append(websocket)
     try: