[BE-03] Remove hardcoded secrets and enforce startup env validation

[Leothosine]

Problem

Three separate security violations exist:

1. src/config/database.config.ts:12 falls back to the hardcoded string 'adetomi' for DATABASE_PASSWORD
2. src/modules/auth/auth.module.ts:21 falls back to 'your-secret-key' for JWT_SECRET
3. .env.example contains real credentials: a live Neon DB password and a Cloudinary API secret

The app starts silently in an insecure state when required env vars are missing, with no error or warning to the operator.

Proposed Solution

1. Add a Joi validation schema to ConfigModule.forRoot({ validationSchema: ... }) listing every required env variable
2. Set validationOptions: { abortEarly: false } so all missing vars are reported at once
3. Remove all hardcoded fallback strings for secrets
4. Replace all real credential values in .env.example with your_value_here placeholders
5. Rotate any exposed credentials immediately

Acceptance Criteria

• npm start fails with a clear, specific error listing missing env vars
• No hardcoded secret fallback strings anywhere in config files
• .env.example contains zero real credential values
• Joi schema covers: DATABASE_*, JWT_SECRET, CLOUDINARY_*, REDIS_*, THROTTLE_*

[funds0033-cmyk]

pls i would like to work on this i have the skillset to deliver your request flawlessly kindly assign it to me