fix(security): remove hardcoded Flask secret key

Replace hardcoded Flask secret key with environment variable to
prevent session hijacking and CSRF attacks.

Changes:
- Load secret key from TISBACKUP_SECRET_KEY environment variable
- Fall back to cryptographically secure random key using secrets module
- Log warning when random key is used (sessions won't persist)
- Add environment variable example to README.md Docker Compose config
- Add setup instructions in Configuration section

Security improvements:
- Eliminates hardcoded secret in source code
- Uses secrets.token_hex(32) for cryptographically strong random generation
- Sessions remain secure even without env var (though won't persist)
- Prevents session hijacking and CSRF bypass attacks

Documentation:
- Update README.md with TISBACKUP_SECRET_KEY setup instructions
- Include command to generate secure random key
- Update SECURITY_IMPROVEMENTS.md with implementation details
- Mark hardcoded secret key issue as resolved

Setup:
```bash
# Generate secure key
python3 -c "import secrets; print(secrets.token_hex(32))"

# Set in environment
export TISBACKUP_SECRET_KEY=your-key-here
```

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

README.md

@@ -47,6 +47,10 @@ services:
       - ./backup/:/backup/
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
+    environment:
+      # SECURITY: Set a unique secret key for Flask session security
+      # Generate with: python3 -c "import secrets; print(secrets.token_hex(32))"
+      - TISBACKUP_SECRET_KEY=your-secret-key-here-change-me
     restart: unless-stopped
     ports:
       - 9980:8080
@@ -70,6 +74,12 @@ services:
 
  * Provide an SSH key and store it in `./ssh`
  * Setup config files in the `./config` directory
+ * **SECURITY**: Generate and set a secure Flask secret key:
+   ```bash
+   # Generate a secure random secret key
+   python3 -c "import secrets; print(secrets.token_hex(32))"
+   ```
+   Then add it to your `compose.yml` as the `TISBACKUP_SECRET_KEY` environment variable
 
 **tisbackup-config.ini**