fix(config): harden default JWT secret

Replace known development JWT secret placeholders with an ephemeral runtime secret during config loading.

Return LoadInfo so startup can warn when token persistence depends on a stable configured secret.

Update config docs and tests for default, legacy placeholder, custom, env, and empty secret behavior.

docs/development.md

@@ -52,9 +52,14 @@ storage:
         path: data/files
 
 jwt:
-    secret: changeme-in-production
+    secret: dev-secret-do-not-use-in-production
     access_ttl: 15m
     refresh_ttl: 168h
 ```
 
 Environment variables use `MYGO_` prefix with underscore separators: `MYGO_SERVER_PORT=8080`, `MYGO_JWT_SECRET=...`
+
+The default JWT secret is a development placeholder. At startup, MyGO replaces
+it with an ephemeral runtime secret; set a stable `jwt.secret` or
+`MYGO_JWT_SECRET` when tokens must survive restarts or when running multiple
+instances.