Fix config path, env secrets, and align API calls

backend/auth/token.py

@@ -1,10 +1,18 @@
+import os
 from flask import request
 from jwt import decode, ExpiredSignatureError, InvalidTokenError
 from util.logger import logger
 
-SECRET_KEY = "bitte_hier_dein_geheimes_passwort_setzen"  # später .env verwenden
+# SECRET_KEY must be provided via environment for production safety
+SECRET_KEY = os.environ.get("SECRET_KEY")
+if not SECRET_KEY:
+    logger.error("SECRET_KEY environment variable is not set – authentication disabled until configured.")
+
 
 def verify_token():
+    if not SECRET_KEY:
+        return None
+
     auth_header = request.headers.get("Authorization", "")
     if not auth_header.startswith("Bearer "):
         logger.warning("🔐 Invalid Bearer header")