fix: make frontend_url and jwt_secret optional with defaults

- frontend_url defaults to "*" (allow all origins for public API)
- jwt_secret defaults to a placeholder (should be overridden with env var)

This allows the app to start on Hugging Face Spaces without these env vars set.

Co-Authored-By: Claude (glm-4.7) <noreply@anthropic.com>

core/config.py

@@ -18,12 +18,12 @@ class Settings(BaseSettings):
     database_url: str
 
     # JWT
-    jwt_secret: str
+    jwt_secret: str = "change-me-in-production-use-env-var"
     jwt_algorithm: str = "HS256"
     jwt_expiration_days: int = 7
 
-    # CORS
-    frontend_url: str
+    # CORS (optional, defaults to allow all for public API)
+    frontend_url: str = "*"
 
     # Environment
     environment: str = "development"