fix: refuse the example placeholder signing_key at startup

Reject the exact config.example.yml placeholder in validate() with an
error naming signing_key, so a container or file-based deployment that
never changed it fails fast instead of signing URLs with a public key.
The signing-key checks move into a validateSigningKey helper, keeping
validate() within the cyclomatic-complexity limit.

Model: opus-4-8

internal/config/config.go

@@ -67,6 +67,9 @@ var (
 	errPortOutOfRange    = errors.New("outside the valid port range")
 	errTooFewConnections = errors.New("must be at least 1")
 	errValueTooShort     = errors.New("value too short")
+	errPlaceholderKey    = errors.New(
+		"is the placeholder from config.example.yml; " +
+			"generate a real key with: openssl rand -base64 32")
 	errMustBeSetTogether = errors.New("must be set together")
 	errMustNotBeNegative = errors.New("must not be negative")
 	errOverflowsInt64    = errors.New("overflows a 64-bit integer")
@@ -347,10 +350,10 @@ func (c *Config) ensureStateDirWritable() error {
 	return nil
 }
 
-// validate checks that all required configuration values are set and
-// that every value is within its valid range.
-func (c *Config) validate() error {
-	// The signing key value is never echoed in error messages.
+// validateSigningKey checks that the signing key is present, long
+// enough, and not the public placeholder from config.example.yml. The
+// key value itself is never echoed in error messages.
+func (c *Config) validateSigningKey() error {
 	if c.SigningKey == "" {
 		return fmt.Errorf("config key %q: %w", keySigningKey, errValueRequired)
 	}
@@ -362,6 +365,21 @@ func (c *Config) validate() error {
 			keySigningKey, errValueTooShort, minKeyLength, len(c.SigningKey))
 	}
 
+	if c.SigningKey == placeholderSigningKey {
+		return fmt.Errorf("config key %q: %w", keySigningKey, errPlaceholderKey)
+	}
+
+	return nil
+}
+
+// validate checks that all required configuration values are set and
+// that every value is within its valid range.
+func (c *Config) validate() error {
+	err := c.validateSigningKey()
+	if err != nil {
+		return err
+	}
+
 	const maxPort = 65535
 	if c.Port < 1 || c.Port > maxPort {
 		return fmt.Errorf("config key %q: value %d is %w 1-%d",