Express session secret hardcoded to "keyboard cat" - anyone can forge session cookies

[amaydixit11]

Express session secret is hardcoded to "keyboard cat" in backend/index.js:40:

app.use(
  session({
    secret: "keyboard cat",
    resave: false,
    saveUninitialized: false,
    ...
  })
);

Why this matters

"keyboard cat" is the default example from express-session documentation. Anyone who reads this repo's code can:

1. Forge session cookies - craft a valid session for any user including admins
2. Session hijacking - since session data is signed with a known secret
3. Bypass authentication - craft a payload that sets req.session.passport.user to any user ID

How to fix

1. Generate a cryptographically random secret
2. Add it to .env as SESSION_SECRET
3. Update the code to use process.env.SESSION_SECRET
4. Regenerate the secret before deploying to production