sửa lai docker compose

backend/app/security.py

@@ -5,7 +5,17 @@ import bcrypt
 from jose import JWTError, jwt
 
 # ── Config (override via environment variables) ───────────────────────────────
-SECRET_KEY: str = os.environ["JWT_SECRET_KEY"]          # must be set — no default
+_raw_secret = os.getenv("JWT_SECRET_KEY", "")
+if not _raw_secret:
+    import warnings
+    _raw_secret = "lms_dev_jwt_secret_change_in_production"
+    warnings.warn(
+        "JWT_SECRET_KEY is not set — using insecure default. "
+        "Set it in .env before going to production.",
+        RuntimeWarning,
+        stacklevel=1,
+    )
+SECRET_KEY: str = _raw_secret
 ALGORITHM: str = os.getenv("JWT_ALGORITHM", "HS256")
 ACCESS_TOKEN_EXPIRE_MINUTES: int = int(
     os.getenv("ACCESS_TOKEN_EXPIRE_MINUTES", "60")