Harden JWT auth: require strong secret, expire tokens

Security review flagged a hardcoded JWT secret fallback. A booth machine
started without JWT_SECRET would have signed tokens with a publicly-known
default, letting anyone forge an admin token — defeating the local-auth
anti-fraud model.

- requireJwtSecret() refuses to start on a missing, <32-char, or placeholder
  secret (no insecure default).
- Add sign.expiresIn: 8h so minted tokens expire (bound to a shift).
- Add apps/server/.env.example documenting JWT_SECRET + how to generate it.

Verified: refuses with no secret and with the old placeholder; boots and
serves /health with a valid `openssl rand -hex 32` secret.

apps/server/.env.example

@@ -0,0 +1,11 @@
+# Copy to .env and fill in. The server refuses to start without a strong JWT_SECRET.
+#
+# Generate a strong secret:
+#   openssl rand -hex 32
+JWT_SECRET=
+
+# Optional
+# PORT=3000
+# HOST=0.0.0.0
+# LOG_LEVEL=info
+# DATABASE_URL=./parking.sqlite