[WIP] Update security settings for OAuth transport and validation

[Copilot]

WS1: Runtime Security Baseline Implementation Plan

• Analyze current security state and identify insecure defaults
• Create security validation module for startup checks
• Update OAuth transport to conditional (only allow insecure for localhost/DEBUG)
• Add APP_SECRET_KEY validation (enforce non-empty in production)
• Update config.py.example with security notes
• Add startup security validation in sahasrahbot.py entry point
• Add security validation to oauth_client.py (Authlib path) - Already secure
• Test security validation with various configurations
• Update documentation to reflect security requirements
• Run code review
• Run security scanning

Original prompt

---

This section details on the original issue you should resolve

<issue_title>WS1: Runtime Security Baseline (OAuth transport, secrets, startup validation)</issue_title>
<issue_description>## Context
Security-first modernization priority from the umbrella vision.

Objective

Eliminate insecure runtime defaults and enforce startup-time security validation.

Scope

• Remove insecure OAuth transport outside local/dev flows
• Enforce non-empty app secret requirements for non-test runtime
• Add startup security validation checks and actionable failures

Acceptance Criteria

• Insecure transport is not enabled by default in non-local runtime
• Secret validation fails fast when missing/invalid
• Security gate evidence captured in compatibility packet

References

• docs/plans/application_modernization_vision_2026_2027.md
• docs/context/active_state.md</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes WS1: Runtime Security Baseline (OAuth transport, secrets, startup validation) #92

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.