Refactor JWT_SECRET handling and add setup warning page

src/router.ts

@@ -89,6 +89,7 @@ export async function handleRequest(request: Request, env: Env): Promise<Respons
 
   // Route matching
   try {
+
     // Setup page (root)
     if (path === '/' && method === 'GET') {
       return handleSetupPage(request, env);
@@ -181,6 +182,12 @@ export async function handleRequest(request: Request, env: Env): Promise<Respons
       return handleRegister(request, env);
     }
 
+    // If JWT_SECRET is not safely configured, block any other endpoints.
+    const secret = (env.JWT_SECRET || '').trim();
+    if (!secret || secret.length < 32) {
+      return errorResponse('Server configuration error: JWT_SECRET is not set or too weak', 500);
+    }
+
     // All other API endpoints require authentication
     const auth = new AuthService(env);
     const authHeader = request.headers.get('Authorization');