Replace IDP token passthrough with backend-issued JWT for iOS auth

iOS clients now exchange the OIDC authorization code for a backend-signed
HS256 JWT via POST /auth/token. All subsequent API requests authenticate
using this JWT as a Bearer token, verified locally — no per-request IDP
call is needed. Web frontend session-cookie auth is unchanged.

backend/src/config/index.ts

@@ -25,6 +25,13 @@ export const config = {
     maxAge: 24 * 60 * 60 * 1000, // 24 hours
   },
 
+  jwt: {
+    // Dedicated secret for backend-issued JWTs. Falls back to SESSION_SECRET so
+    // existing single-secret deployments work without any config change.
+    secret: process.env.JWT_SECRET || process.env.SESSION_SECRET || "default-secret-change-in-production",
+    expiresIn: 30 * 24 * 60 * 60, // 30 days in seconds
+  },
+
   cors: {
     origin: process.env.APP_URL || "http://localhost:5173",
     credentials: true,