fix(security): remove hardcoded Flask secret key

Replace hardcoded Flask secret key with environment variable to
prevent session hijacking and CSRF attacks.

Changes:
- Load secret key from TISBACKUP_SECRET_KEY environment variable
- Fall back to cryptographically secure random key using secrets module
- Log warning when random key is used (sessions won't persist)
- Add environment variable example to README.md Docker Compose config
- Add setup instructions in Configuration section

Security improvements:
- Eliminates hardcoded secret in source code
- Uses secrets.token_hex(32) for cryptographically strong random generation
- Sessions remain secure even without env var (though won't persist)
- Prevents session hijacking and CSRF bypass attacks

Documentation:
- Update README.md with TISBACKUP_SECRET_KEY setup instructions
- Include command to generate secure random key
- Update SECURITY_IMPROVEMENTS.md with implementation details
- Mark hardcoded secret key issue as resolved

Setup:
```bash
# Generate secure key
python3 -c "import secrets; print(secrets.token_hex(32))"

# Set in environment
export TISBACKUP_SECRET_KEY=your-key-here
```

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

tisbackup_gui.py

@@ -62,7 +62,21 @@ mindate = None
 error = None
 info = None
 app = Flask(__name__)
-app.secret_key = "fsiqefiuqsefARZ4Zfesfe34234dfzefzfe"
+
+# Load secret key from environment variable or generate a secure random one
+SECRET_KEY = os.environ.get("TISBACKUP_SECRET_KEY")
+if not SECRET_KEY:
+    # Generate a secure random secret key if not provided
+    import secrets
+    SECRET_KEY = secrets.token_hex(32)
+    # Warn if using a random key (sessions won't persist across restarts)
+    logging.warning(
+        "TISBACKUP_SECRET_KEY environment variable not set. Using a randomly generated secret key. "
+        "Sessions will not persist across application restarts. "
+        "Set TISBACKUP_SECRET_KEY environment variable for production use."
+    )
+
+app.secret_key = SECRET_KEY
 app.config["PROPAGATE_EXCEPTIONS"] = True
 
 tasks_db = os.path.join(tisbackup_root_dir, "tasks.sqlite")