Update env example and settings configuration.

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -1,5 +1,7 @@
 # IMPORTANT: must match the FunZone backend SECRET_KEY so admin JWTs validate here.
-SECRET_KEY=your-super-secret-key-change-in-production
+# Generate: python -c "import secrets; print(secrets.token_urlsafe(50))"
+# App will refuse to start if this is missing or still a placeholder.
+SECRET_KEY=
 
 DEBUG=True
 ALLOWED_HOSTS=localhost,127.0.0.1,0.0.0.0,testserver