JWT improvements FMSG_API_JWT_SECRET starting with base64: decoded as base64

[markmnl]

No description provided.

[Copilot]

Pull request overview

This PR updates JWT secret handling so FMSG_API_JWT_SECRET can optionally be provided as base64-encoded bytes (via a base64: prefix), enabling non-text/binary-safe HMAC keys to be configured via environment variables.

Changes:

• Change middleware.SetupJWT to accept HMAC key bytes ([]byte) instead of a string.
• Add parseSecret in main.go to decode FMSG_API_JWT_SECRET when prefixed with base64:.
• Update JWT middleware test and README to reflect the new behavior.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
src/middleware/jwt_test.go	Updates test callsite to pass key bytes into SetupJWT.
src/middleware/jwt.go	Changes SetupJWT signature to accept []byte and uses it directly as the middleware key.
src/main.go	Adds base64-prefixed secret parsing and passes derived key bytes into SetupJWT.
README.md	Documents base64: prefix support for FMSG_API_JWT_SECRET.

[Copilot]

parseSecret can return an empty HMAC key when FMSG_API_JWT_SECRET is set to just base64: (or base64 that decodes to an empty byte slice). That would silently run JWT validation with an empty secret, which is a security misconfiguration. Consider validating that the decoded key length is > 0 (and failing fast) before returning it; similarly consider trimming whitespace around the base64 payload to avoid surprising decode failures from env formatting.

Suggested change

	b, err := base64.StdEncoding.DecodeString(s[len(prefix):])
	if err != nil {
	log.Fatalf("FMSG_API_JWT_SECRET has base64: prefix but is not valid base64: %v", err)
	}
	payload := strings.TrimSpace(s[len(prefix):])
	b, err := base64.StdEncoding.DecodeString(payload)
	if err != nil {
	log.Fatalf("FMSG_API_JWT_SECRET has base64: prefix but is not valid base64: %v", err)
	}
	if len(b) == 0 {
	log.Fatalf("FMSG_API_JWT_SECRET must not decode to an empty key")
	}