fix: replace hardcoded JWT and session keys with env var lookups in auth examples

[saaa99999999]

Summary

The official Kratos JWT auth example and session example use hardcoded signing keys in the source code itself.

What was there

auth/jwt/main.go — the JWT authentication example hardcodes two keys:

func main() {
    testKey := "testKey"
    httpSrv := http.NewServer(
        http.Middleware(
            jwt.Server(func(token *jwtv5.Token) (interface{}, error) {
                return []byte(testKey), nil   // signs AND verifies with "testKey"
            }),
        ),
    )
    // ...
    serviceTestKey := "serviceTestKey"   // second hardcoded key

This is the top result when searching "kratos jwt example". The key "testKey" signs and verifies all tokens.

http/session/main.go — Redis session encryption key:

store, err := sessions.NewRedisStore(rdCmd, []byte("secret"))

What changed

Added getEnvOrDefault() helper, replaced hardcoded strings:

func getEnvOrDefault(key, defaultVal string) string {
    if val := os.Getenv(key); val != "" {
        return val
    }
    return defaultVal
}

// auth/jwt
testKey := getEnvOrDefault("JWT_TEST_KEY", "change-me-in-production")
serviceTestKey := getEnvOrDefault("JWT_SERVICE_TEST_KEY", "change-me-in-production")

// http/session
sessions.NewRedisStore(rdCmd, []byte(getEnvOrDefault("SESSION_SECRET_KEY", "change-me-in-production")))

See also: CWE-798