Full secrets-at-rest audit beyond the flagged base64 encryption issue

[phertyameen]

Location

repo-wide, tracked via SECURITY_AUDIT.md

Problem

The README flags secret-key encryption specifically, but a broader audit is needed covering JWT_SECRET, database credentials, and any other sensitive configuration to confirm nothing else is under-protected in a similar way.

Acceptance Criteria

• Every category of sensitive data at rest inventoried and its current protection level assessed
• Any additional gaps found are filed as their own follow-up issues, not silently fixed without tracking
• Findings appended to SECURITY_AUDIT.md