Test?

docker-compose.yml

@@ -23,6 +23,12 @@ services:
       # 127.0.0.1 is itself — with the default URI the API crashed on connect
       # and nginx answered 502. Mongo is a service of this stack now.
       MONGO_URI: mongodb://mongo:27017/mathew
+      # Interpolated from /var/www/app/.env on the deploy host (never
+      # committed, never overwritten by the pipeline's scp). Create it once:
+      #   echo "JWT_SECRET=$(openssl rand -hex 32)" >> /var/www/app/.env
+      # Left unset, the backend falls back to the dev key in the repo —
+      # anyone could then forge sessions against the public site.
+      JWT_SECRET: ${JWT_SECRET:-}
     depends_on:
       mongo:
         condition: service_healthy