fix: add startup warning when REQUEST_SIGNING_SECRET is unset (#516)

[Fang0067]

Overview

Adds a startup warning when REQUEST_SIGNING_SECRET is not set in the environment, alerting operators that admin request signing verification is inactive.

Related Issue

Closes #516

Changes

Request Signing & Server Startup

• [MODIFY] src/index.ts
  • Added a startup warning check for REQUEST_SIGNING_SECRET analogous to the ADMIN_API_KEY check.
• [MODIFY] src/__tests__/requestSigning.test.ts
  • Added unit test verifying the startup check when REQUEST_SIGNING_SECRET is unset.

Verification Results

$ npx jest src/__tests__/requestSigning.test.ts
PASS src/__tests__/requestSigning.test.ts
  requestSigning middleware
    ✓ should call next() when REQUEST_SIGNING_SECRET is not set (4 ms)
    ✓ should return 401 when signature header is missing (3 ms)
    ✓ should return 401 when timestamp header is missing (1 ms)
    ✓ should return 401 when timestamp is expired
    ✓ should return 401 when signature is invalid (2 ms)
    ✓ should return 401 for a wrong signature token
    ✓ should return 401 for a partial signature match (1 ms)
    ✓ should return 401 for an empty signature token
    ✓ should call next() with valid signature (1 ms)
    ✓ should handle string body correctly (4 ms)
    startup check
      ✓ warns when REQUEST_SIGNING_SECRET is not configured (3 ms)

Test Suites: 1 passed, 1 total
Tests:       11 passed, 11 total
Snapshots:   0 total

Acceptance Criteria	Status
Startup warning logged when REQUEST_SIGNING_SECRET is unset	✅ Implemented in src/index.ts
No-op behavior retained without breaking existing requests	✅ Preserved
Unit tests for request signing & startup verification	✅ Passing

[drips-wave]

@Fang0067 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Fang0067]

@Heliobond Hi! This PR is open and ready for review — happy to address any feedback. Thanks!