fix(security): JWT require env, remove *** token, WS auth disabled

fix(automation): implement all 6 actions + real cron parser
fix(db): pq.Array for TEXT[], add sqlmock tests
fix(schema): single source migrations
docs: v2 architecture + frontend refactor proposals

backend/config/config.go

@@ -24,7 +24,7 @@ func Load() *Config {
 	return &Config{
 		Port:           getEnv("PORT", "9092"),
 		DBURL:          getEnv("DB_URL", "postgres://boc:boc@localhost:5432/boc?sslmode=disable"),
-		JWTSecret:      getEnv("JWT_SECRET", "change-me-in-production"),
+		JWTSecret:      requireEnv("JWT_SECRET"),
 		AMOSBaseURL:    getEnv("AMOS_BASE_URL", "http://localhost:9000"),
 		CORSOrigins:    splitComma(getEnv("CORS_ORIGINS", "http://localhost:3000")),
 		MigrationsDir:  getEnv("MIGRATIONS_DIR", "./db/migrations"),
@@ -44,6 +44,14 @@ func getEnv(key, fallback string) string {
 	return fallback
 }
 
+func requireEnv(key string) string {
+	v := os.Getenv(key)
+	if v == "" {
+		panic("required environment variable not set: " + key)
+	}
+	return v
+}
+
 func splitComma(s string) []string {
 	parts := strings.Split(s, ",")
 	out := make([]string, 0, len(parts))