Derive workspace session signing from encryption key - #4

Summary

Removes the separate AUTH_SIGNING_KEY deployment dependency while preserving signed workspace-session integrity.

Implementation

• derive a 256-bit HMAC signing key from the decoded Fernet CONNECTION_ENCRYPTION_KEY
• use a QueryMindAI-specific domain-separation label so encryption and signing do not use identical key material directly
• reject missing, malformed, or incorrectly sized Fernet keys
• remove AUTH_SIGNING_KEY from settings, Compose, Render, and environment examples
• update security, deployment, API, and local-development documentation
• add missing-key session coverage

Rotating CONNECTION_ENCRYPTION_KEY now invalidates existing workspace sessions in addition to making previously encrypted credentials unreadable. That coupling is documented and is acceptable for the current anonymous-workspace model.

Validation

• Backend tests: 59 passed
• render.yaml parses successfully
• docker-compose.yml parses successfully
• no AUTH_SIGNING_KEY references remain

Render change

After merge, querymind-api only needs CONNECTION_ENCRYPTION_KEY for both credential encryption and derived session signing. Existing AUTH_SIGNING_KEY values can be deleted from Render.