feat: add signed media URL configuration

app/core/config.py

@@ -38,6 +38,8 @@ class Settings(BaseSettings):
     download_timeout_seconds: float = Field(default=300.0, gt=0)
     allow_private_urls: bool = False
     base_url: str = ""
+    media_signing_secret: SecretStr | None = None
+    media_signed_url_ttl_seconds: int = Field(default=3600, ge=60, le=86_400)
     ffmpeg_binary: str = "ffmpeg"
     ffprobe_binary: str = "ffprobe"
     auth_enabled: bool = True
@@ -253,6 +255,8 @@ class Settings(BaseSettings):
             errors.append("SECURITY_DATABASE_ROLE is required in production")
         if not self.auth_enabled:
             errors.append("AUTH_ENABLED must be true in production")
+        if not self.media_signing_secret or len(self.media_signing_secret.get_secret_value().encode()) < 32:
+            errors.append("MEDIA_SIGNING_SECRET must be at least 32 bytes in production")
         if not origins:
             errors.append("CORS_ALLOWED_ORIGINS must include the HTTPS Vercel frontend origin")
         elif any(urlparse(origin).scheme != "https" for origin in origins):