Require signing_key at startup, add default config

- Add config validation: signing_key required, minimum 32 characters
- Server now fails to start without valid signing_key (no more runtime errors)
- Add config.example.yml with default whitelist hosts
- Copy config to /etc/pixa/config.yml in Docker image
- Update entrypoint to use --config /etc/pixa/config.yml
- Add config.dev.yml for local Docker development
- Mount dev config in make devserver

Dockerfile

@@ -35,14 +35,17 @@ RUN apk add --no-cache \
 # Copy binary from builder
 COPY --from=builder /pixad /usr/local/bin/pixad
 
-# Create non-root user and data directory
+# Create non-root user, config directory, and data directory
 RUN adduser -D -H -s /sbin/nologin pixad && \
-    mkdir -p /var/lib/pixa && \
+    mkdir -p /var/lib/pixa /etc/pixa && \
     chown pixad:pixad /var/lib/pixa
 
+# Copy default config (edit signing_key before use)
+COPY config.example.yml /etc/pixa/config.yml
+
 USER pixad
 WORKDIR /var/lib/pixa
 
 EXPOSE 8080
 
-ENTRYPOINT ["/usr/local/bin/pixad"]
+ENTRYPOINT ["/usr/local/bin/pixad", "--config", "/etc/pixa/config.yml"]