# TODO

- [x] Add guardrails for missing JWT_SECRET in backend routes/middleware to remove jsonwebtoken crash stack traces.

- [ ] Add/ensure backend/.env.example exists and documents required env vars (especially JWT_SECRET).
- [ ] (If allowed by tooling) create a minimal local backend/.env with placeholder JWT_SECRET for development.
- [ ] Restart backend and test POST /api/auth/login.

