fix/mitigate secret key security vulnerability

[1amKhush]

Description

This PR addresses a critical security vulnerability where the process-pastry configuration manager was exposed without authentication. Because the startServer config omitted credentials, process-pastry bypassed authentication entirely, leaving sensitive endpoints (like /process-pastry/api/existing and /process-pastry/api/config) publicly accessible. This allowed unauthenticated reads of SERVER_SECRET_KEY and arbitrary environment variable writes/process restarts.

To comprehensively harden the service, this PR introduces a 2-layer defense mechanism.

Changes Made

1. Enforced Basic Auth: Updated manager.ts to inject authUser and authPassword from the environment (MANAGER_USER / MANAGER_PASSWORD).
2. Auto-Generated Secure Defaults: If a user forgets to set a MANAGER_PASSWORD in their environment, the manager will now generate a 16-byte cryptographically secure random password on startup and print it to the console. The manager will never start unprotected.
3. Localhost Binding: Updated docker-compose.yml to bind port 3000 exclusively to 127.0.0.1 by default. This prevents Docker from accidentally bypassing host firewalls (like UFW) and exposing the dashboard to the public internet on standard VPS deployments.
4. Documentation: Updated .env.example to include the new authentication variables.

How to Test

1. Run the service using Docker Compose: docker-compose up --build.
2. Observe the startup logs. If you haven't set MANAGER_PASSWORD in your .env, you should see a newly generated password printed in the console.
3. Attempt to access http://localhost:3000/process-pastry/api/config from an external tool (like cURL or Postman) without auth. You should receive a 401 Unauthorized response.
4. Access http://localhost:3000 in your browser. You will be prompted for Basic Auth. Use admin (or your custom user) and the generated password to log in successfully.
5. Verify that the port is only bound locally by running netstat -tuln | grep 3000 (it should bind to 127.0.0.1:3000).

[ContextVM-org]

Thanks you so much!