feat(security): Phase 1 — critical security fixes and hardening

- #42: Remove hardcoded ENCRYPTION_KEY fallback from config.js,
  add startup validation for BOT_TOKEN and ENCRYPTION_KEY length
- #43: Fix SQL injection vulnerabilities — add ALLOWED_TABLES
  whitelist in database.js, ALLOWED_USER_FIELDS in userService.js,
  validate table names before PRAGMA
- #44: Fix race condition in purchaseService.js — wrap createPurchase
  in BEGIN IMMEDIATE TRANSACTION, add atomic balance/stock checks
- #41: Move all secrets from docker-compose.yml to .env file,
  use env_file directive
- #45: Replace MD5 tx_hash with crypto.randomUUID()
- #46: Upgrade KDF from SHA-256 to HKDF for mnemonic encryption,
  add backward compatibility for legacy format
- #47: Add input validation across all handlers — walletType
  whitelist, string length limits, numeric ID checks, price bounds

New files:
- src/utils/encryption.js (HKDF key derivation)
- src/__tests__/security.test.js (SQL injection prevention tests)

Closes: #41, #42, #43, #44, #45, #46, #47

docker-compose.yml

@@ -7,20 +7,8 @@ services:
     hostname: telegram_shop_prod
     container_name: telegram_shop_prod
     restart: always
-    environment:
-      - WG_ENABLED=false # Включение/выключение WireGuard (true/false)
-      - BOT_TOKEN=7626758249:AAEdcbXJpW1VsnJJtc8kZ5VBsYMFR242wgk # Токен Telegram бота
-      - ADMIN_IDS=732563549,390431690,217546867 # ID администраторов через запятую
-      - SUPPORT_LINK=https://t.me/neroworm # Ссылка на поддержку
-      - CATALOG_PATH=./catalog # Путь к каталогу товаров 
-      - COMMISSION_ENABLED=true # Включение комиссии (true/false)
-      - COMMISSION_PERCENT=5 # Процент комиссии
-      # Кошельки для комиссий:
-      - COMMISSION_WALLET_BTC=bc1qyourbtcaddress # Bitcoin
-      - COMMISSION_WALLET_LTC=ltc1qyourltcaddress # Litecoin
-      - COMMISSION_WALLET_USDT=0x654dbef74cae96f19aa03e1b0abf569b111572cc # USDT (ERC-20)
-      - COMMISSION_WALLET_USDC=0xYourUsdcAddress # USDC (ERC-20)
-      - COMMISSION_WALLET_ETH=0xYourEthAddress # Ethereum
+    env_file:
+      - .env
     volumes:
       - ./db:/app/db/ # Синхронизация базы данных
       - ./src:/app/src/ # Синхронизация исходного кода