fix: complete security vulnerability remediation

Critical Security Fixes:
- Fix JWT secret derivation vulnerability - replace deriveJWTSecret with cryptographically secure GenerateSecureToken
- Secure setup interface - remove JWT secret display and API response exposure
- Fix database migration 012 parameter naming conflict in mark_registration_token_used function
- Restore working Docker Compose environment variable configuration

Security Impact:
- Eliminates system-wide compromise risk from admin credential exposure
- Removes sensitive JWT secret exposure during setup process
- Ensures cryptographically secure JWT token generation
- Fixes agent registration and token creation functionality

Testing:
- Agent registration working properly
- Token consumption tracking functional
- Registration tokens created without 500 errors
- Secure JWT secret generation verified

aggregator-server/internal/database/migrations/012_add_token_seats.up.sql

@@ -63,7 +63,8 @@ END;
 $$ LANGUAGE plpgsql;
 
 -- Update mark_registration_token_used function to increment seats
-CREATE OR REPLACE FUNCTION mark_registration_token_used(token_input VARCHAR, agent_id_param UUID)
+DROP FUNCTION IF EXISTS mark_registration_token_used(VARCHAR, UUID);
+CREATE FUNCTION mark_registration_token_used(token_input VARCHAR, agent_id_param UUID)
 RETURNS BOOLEAN AS $$
 DECLARE
     rows_updated INTEGER;  -- Fixed: Changed from BOOLEAN to INTEGER to match ROW_COUNT type

config/.env.bootstrap.example

@@ -23,4 +23,4 @@ REDFLAG_JWT_SECRET=CHANGE_ME_JWT_SECRET_AT_LEAST_32_CHARS_LONG
 # Token Configuration
 REDFLAG_TOKEN_EXPIRY=24h
 REDFLAG_MAX_TOKENS=100
-REDFLAG_MAX_SEATS=10
+REDFLAG_MAX_SEATS=10

docker-compose.yml

@@ -9,6 +9,7 @@ services:
       POSTGRES_INITDB_ARGS: "--encoding=UTF-8 --lc-collate=C --lc-ctype=C"
     volumes:
       - postgres-data:/var/lib/postgresql/data
+      - ./config/.env:/shared/.env
     ports:
       - "5432:5432"
     healthcheck:
@@ -18,7 +19,7 @@ services:
       retries: 5
     restart: unless-stopped
     env_file:
-      - ${ENV_FILE:-./config/.env}
+      - ./config/.env
 
   server:
     build:
@@ -28,6 +29,7 @@ services:
     volumes:
       - server-config:/app/config
       - server-data:/app/data
+      - ./config/.env:/shared/.env
     depends_on:
       postgres:
         condition: service_healthy
@@ -36,7 +38,7 @@ services:
     command: ["./redflag-server"]
     restart: unless-stopped
     env_file:
-      - ${ENV_FILE:-./config/.env}
+      - ./config/.env
 
   web:
     build: