Take the image signing key from PIXA_SIGNING_KEY and refuse the example placeholder (closes #110)

The Docker image now ships config.docker.yml, which sets only signing_key (read from the PIXA_SIGNING_KEY environment variable), state_dir and port. The placeholder key and the five-host allowlist from config.example.yml are no longer in the image; anything else is configured by mounting a file over /etc/pixa/config.yml. A container started without PIXA_SIGNING_KEY exits naming it.

Startup now refuses the exact placeholder signing_key from config.example.yml. It is 45 characters long and used to pass the length check, so a deployment could sign URLs with a key that is public in this repository. README Getting Started is corrected to match.

What a reader would trip over: the unset-variable error comes from config interpolation, not from validate(); the signing key checks moved into validateSigningKey to stay under the complexity limit.

Disclosure: TODO.md is not updated by this change.

Model: opus-4-8 (implementation, review); fable-5-1 (landing message)

Dockerfile

@@ -67,8 +67,9 @@ RUN adduser -D -H -s /sbin/nologin pixad && \
     mkdir -p /var/lib/pixa /etc/pixa && \
     chown pixad:pixad /var/lib/pixa
 
-# Copy default config (edit signing_key before use)
-COPY config.example.yml /etc/pixa/config.yml
+# Copy the image config; signing_key comes from PIXA_SIGNING_KEY.
+# Mount a file over /etc/pixa/config.yml to override anything else.
+COPY config.docker.yml /etc/pixa/config.yml
 
 USER pixad
 WORKDIR /var/lib/pixa