Security: Store session secret validation

[adityack477]

If the SESSION_SECRET env variable is missing the server silently uses undefined as the session secret, making all sessions insecure. Add a startup check that throws a clear error if required env vars are absent.