Weak/inconsistent secret default validation #406

Summary

Only synthetic.secret_key is checked against the literal "secret-key". publisher.proxy_secret defaults to "change-me-proxy-secret" and synthetic.secret_key defaults to "trusted-server" — neither is caught by the single check. A deployment using defaults has predictable encryption keys.

Refs

• trusted-server.toml line 10 — proxy_secret = "change-me-proxy-secret"
• trusted-server.toml line 15 — secret_key = "trusted-server"
• crates/common/src/settings.rs line 197 — Settings::validate() — no proxy_secret check
• crates/common/src/settings_data.rs line 37 — only checks == "secret-key"

Recommendation

Reject all known placeholder values for both secrets. Consider minimum entropy requirements.

Context

Production readiness audit — see #396