security: require auth on MongoDB and Redis

Enable mongod --auth with root credentials from MONGO_USER/PASSWORD,
and redis-server --requirepass from REDIS_PASSWORD. App connection
strings now embed credentials. All secrets are required (no fallback)
so misconfiguration fails fast at compose time.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

.env.example

@@ -1,24 +1,29 @@
 # Backend Configuration
 NODE_ENV=development
 PORT=5000
-API_URL=http://localhost:5000
 
-# MongoDB Configuration
-MONGODB_URI=mongodb://mongo:27017/podcastic
-MONGODB_USER=podcastic
-MONGODB_PASSWORD=podcastic_dev
+# CORS — comma-separated list of allowed origins (e.g. https://podcastic.example.com,https://app.example.com)
+# Leave empty in dev to allow all origins
+CORS_ORIGIN=
 
-# Redis Configuration
-REDIS_URL=redis://redis:6379
+# MongoDB Configuration (REQUIRED — no defaults)
+MONGO_USER=podcastic
+MONGO_PASSWORD=replace_with_strong_password
+# Used by the app — credentials must match MONGO_USER/MONGO_PASSWORD above
+MONGODB_URI=mongodb://podcastic:replace_with_strong_password@mongodb:27017/podcastic?authSource=admin
 
-# JWT Configuration
-JWT_SECRET=your_super_secret_jwt_key_change_in_production
+# Redis Configuration (REQUIRED — no defaults)
+REDIS_PASSWORD=replace_with_strong_password
+REDIS_URL=redis://:replace_with_strong_password@redis:6379
+
+# JWT Configuration (REQUIRED — min 32 chars, no defaults accepted)
+# Generate: openssl rand -base64 32
+JWT_SECRET=
 JWT_EXPIRES_IN=7d
 JWT_REFRESH_EXPIRES_IN=30d
 
 # Podcast API (PodcastIndex) - OPTIONAL but recommended for search feature
 # Get free API keys at: https://podcastindex-api.com/
-# These enable podcast discovery and search functionality
 PODCAST_INDEX_API_KEY=
 PODCAST_INDEX_API_SECRET=