jwt secret management improvements

[OutOfBedlam]

This pull request introduces significant improvements to the handling of JWT secrets in the server, making secret management more secure and robust. The main changes include generating a secure random JWT secret by default, persisting it to disk with strict permissions, and ensuring the secret is never empty. Additional test coverage has been added for these new behaviors. There are also minor improvements to context handling in the JavaScript engine and its tests.

JWT Secret Management Improvements:

• Replaced the static default JWT secret with a securely generated random secret (32 bytes, hex-encoded) on startup, and added logic to persist this secret to a file with restricted permissions (0600). If the secret file exists, it is loaded and validated; otherwise, it is created. This ensures the JWT secret is always strong and not empty. (mods/server/security.go, mods/server/server.go, mods/server/config.hcl) [1] [2] [3]
• Added helper functions for generating, reading, and securely storing the JWT secret, including error handling for file permissions and invalid secrets. (mods/server/security.go)
• Enforced that a JWT secret must not be empty during configuration, returning an error if this condition is not met. (mods/server/security.go)

Test Coverage:

• Added tests to verify correct creation, loading, and validation of the JWT secret file, including handling of invalid secrets and file permissions. (mods/server/security_test.go)

JavaScript Engine Context Handling:

• Improved context cancellation handling in the JS engine: now, if a context is already canceled, script execution is not started, and the error is returned immediately. Also, the engine ensures that child processes are properly terminated when the context is canceled. (jsh/engine/engine.go, jsh/engine/engine_test.go) [1] [2] [3] [4] [5] [6]

Dependency and Import Updates:

• Added necessary imports for new functionality (e.g., encoding/hex, os, filepath, runtime). (mods/server/security.go, mods/server/security_test.go) [1] [2] [3]

[codecov]

Codecov Report

❌ Patch coverage is 68.49315% with 23 lines in your changes missing coverage. Please review.
✅ Project coverage is 70.64%. Comparing base (e33972f) to head (a3b7e12).

Files with missing lines	Patch %	Lines
mods/server/security.go	74.60%	10 Missing and 6 partials ⚠️
mods/server/server.go	0.00%	4 Missing and 1 partial ⚠️
jsh/engine/engine.go	60.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #489      +/-   ##
==========================================
- Coverage   70.64%   70.64%   -0.01%     
==========================================
  Files         359      359              
  Lines       73698    73771      +73     
==========================================
+ Hits        52064    52112      +48     
- Misses      16096    16112      +16     
- Partials     5538     5547       +9     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[OutOfBedlam]

fix #488