fix(security): fail fast when download HMAC secret is missing (closes #7)

From the PR description

Closes #7.

Problem

backend/src/lib/downloadTokens.ts resolves its HMAC signing key with:

return (
    process.env.DOWNLOAD_SIGNING_SECRET ??
    process.env.SUPABASE_SECRET_KEY ??
    "dev-secret"
);

Because this repo is public, the "dev-secret" fallback is known to everyone. Any deployment that's missing both env vars accepts forged /download/:token signatures for arbitrary R2 paths.

It was also undocumented - DOWNLOAD_SIGNING_SECRET wasn't in backend/.env.example, so a deployer following the README would never know to set it.

Fix

1. Remove the "dev-secret" fallback. getSecret() now throws on first call if neither env var is set, with a message pointing at openssl rand -hex 32.
2. Add DOWNLOAD_SIGNING_SECRET to backend/.env.example with a comment explaining it should be a dedicated random secret distinct from the Supabase key.

Matches the proposed fix in the issue. Two files, +14/-4.