fix: spa_fallback JSONResponse 未导入与 JWT 密钥长度警告

- main.py 补导入 JSONResponse(修复未匹配 /api 路径 500 的 NameError)
- 默认 JWT 密钥补足至 32 字节以上(消除 InsecureKeyLengthWarning)

src/huamenchuang/core/config.py

@@ -11,7 +11,7 @@ class Settings(BaseSettings):
     app_name: str = "huamenchuang"
     # 开发默认 SQLite；生产示例: mysql+aiomysql://user:pwd@localhost/hmc
     database_url: str = _DEFAULT_DB
-    jwt_secret: str = "change-me-in-production"
+    jwt_secret: str = "change-me-in-production-please-set-a-long-random-secret-key"
     jwt_algorithm: str = "HS256"
     jwt_expire_hours: int = 24
     # 套餐/模块开关（code=10086 付费墙语义），key 为模块名

src/huamenchuang/main.py

@@ -53,7 +53,7 @@ async def health():
 
 app.include_router(api_router)
 
-from fastapi.responses import FileResponse  # noqa: E402
+from fastapi.responses import FileResponse, JSONResponse  # noqa: E402
 
 # 静态资源：样板平面图（data/windoor-images）
 _imgdir = Path(__file__).resolve().parents[2] / "data" / "windoor-images"