feat(slice-2): config — session secret, cookie_secure, mailer_kind (INV-8)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/app/platform/config.py

@@ -17,3 +17,24 @@ _DEFAULT_DATABASE_URL = "postgresql://ecomm:ecomm@localhost:5432/ecomm"
 def database_url() -> str:
     """The psycopg DSN for the application database."""
     return os.environ.get("ECOMM_DATABASE_URL") or _DEFAULT_DATABASE_URL
+
+
+# Session signing secret. Dev default is intentionally well-known and insecure — a clean
+# checkout works with no setup; deployed environments MUST supply ECOMM_SESSION_SECRET from
+# Secret Manager (INV-8, §6.6). Rotating it invalidates all sessions at once (§6.2).
+_DEFAULT_SESSION_SECRET = "dev-insecure-session-secret-change-me"
+
+
+def session_secret() -> str:
+    """The HMAC key for signed session cookies (and the one-time-code pepper)."""
+    return os.environ.get("ECOMM_SESSION_SECRET") or _DEFAULT_SESSION_SECRET
+
+
+def cookie_secure() -> bool:
+    """Whether to mark the session cookie Secure (HTTPS-only). True in deployed envs."""
+    return os.environ.get("ECOMM_COOKIE_SECURE", "").strip().lower() in {"1", "true", "yes", "on"}
+
+
+def mailer_kind() -> str:
+    """Which mailer adapter to build: 'log' (dev/tests) or 'smtp' (deployed; SLICE-4)."""
+    return os.environ.get("ECOMM_MAILER") or "log"