PyJWT >=2.10 emits InsecureKeyLengthWarning when HS256 key is <32 bytes

PyJWT 2.10+ added InsecureKeyLengthWarning in jwt/api_jwt.py that fires when the HMAC key used with HS256 is shorter than 32 bytes (256-bit hash output), per RFC 7518 Section 3.2. The check is byte-length only, not entropy. A common trigger is dev placeholder secrets like change-me-dev-secret in .env files. Production deployments with short secrets silently emit this warning to stderr/logs even though signing and verification still work.

Set HS256 JWT secrets to at least 32 bytes. Generate with python -c "import secrets; print(secrets.token_urlsafe(48))". Update dev .env defaults to the same minimum length to suppress the warning and mirror production hygiene.