fix(config): validate JWT_SECRET at startup instead of type: ignore

- jwt_secret defaults to "" (satisfies pyright)
- create_app() raises RuntimeError if JWT_SECRET is empty

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ImTotem

src/bcsd_api/config.py

@@ -3,7 +3,7 @@
 
 class Settings(BaseSettings):
     google_client_id: str = ""
-    jwt_secret: str
+    jwt_secret: str = ""
     jwt_algorithm: str = "HS256"
     jwt_expire_minutes: int = 1440
     google_sheets_id: str = ""

src/bcsd_api/dependencies.py

@@ -14,7 +14,7 @@
 
 @lru_cache
 def get_settings() -> Settings:
-    return Settings()  # type: ignore[call-arg]
+    return Settings()
 
 
 @lru_cache

src/bcsd_api/main.py

@@ -48,6 +48,8 @@ def create_app() -> FastAPI:
         redoc_url=None,
     )
     settings = get_settings()
+    if not settings.jwt_secret:
+        raise RuntimeError("JWT_SECRET is required in .env")
     from . import slack_log
     slack_log.setup(settings.slack_bot_token, settings.slack_error_channel)
     app.add_middleware(