fix: remove unused SESSION_SECRET config

Session security already comes from a cryptographically random
256-bit token (secrets.token_urlsafe) hashed before storage —
SESSION_SECRET was required config that nothing ever read.

.env.example

@@ -1,6 +1,5 @@
 DATABASE_URL=postgresql+asyncpg://quantumancy:quantumancy@localhost:5432/quantumancy
 OLLAMA_BASE_URL=http://10.30.20.107:11434
-SESSION_SECRET=change-me-to-a-random-64-char-string
 PORT=7777
 # LLM tiers on the Ollama box (fast = fragments/ambient, chat = direct contact/minting)
 OLLAMA_FAST_MODEL=granite4.1:3b