Fix prod compose boot failures (empty JWT_SECRET_KEY, missing SIGNING_SECRET)

[HermanPlay]

Context

Production docker-compose/docker-compose.yaml cannot boot as committed.

Problems

1. Backend JWT_SECRET_KEY= is empty (line 36) — internal/config/config.go does log.Panic("JWT_SECRET_KEY is not set") on empty → backend crashes at startup.
2. file-storage has no SIGNING_SECRET (env block lines 23-26: APP_PORT, INTERNAL_PORT, ROOT_DIRECTORY only) — file-storage/internal/config/config.go:49-52 does log.Fatal if SIGNING_SECRET unset → file-storage crashes at startup. Commit d88f0b5 removed it as "stale", but the config still requires it.
3. Missing values are presumably supplied at deploy-time by an external mechanism — if so, document it (.env, .env.prod, secret injection); otherwise set real values. The kT0E394Tvs value exists in the dev compose.

Required changes

• Ensure JWT_SECRET_KEY and SIGNING_SECRET are always set for prod compose (via compose env, .env file, or documented external secret injection — but never a committed hardcoded secret in a public repo).
• Verify docker compose config validates and the stack boots.

Acceptance criteria

• docker compose up boots backend + file-storage without config panics.
• No secret values committed to the repo.