feat: add cluster token encryption

platform/config/config.go

@@ -22,6 +22,7 @@ type Config struct {
 	SupabaseJWTSecret string
 	RedisAddr         string
 	AppSiteURL        string
+	MasterKeyBase64   string
 }
 
 func Load() (Config, error) {
@@ -52,6 +53,7 @@ func Load() (Config, error) {
 		SupabaseJWTSecret: os.Getenv("SUPABASE_JWT_SECRET"),
 		RedisAddr:         getenv("REDIS_ADDR", "localhost:6379"),
 		AppSiteURL:        getenv("APP_SITE_URL", "http://localhost:5173"),
+		MasterKeyBase64:   os.Getenv("MASTER_KEY_BASE64"),
 	}, nil
 }
 

platform/config/config_test.go

@@ -42,6 +42,7 @@ func TestLoadOverrides(t *testing.T) {
 	t.Setenv("CONSOLE_PROXY_ADDR", ":9001")
 	t.Setenv("WORKER_CONCURRENCY", "12")
 	t.Setenv("REDIS_ADDR", "redis:6379")
+	t.Setenv("MASTER_KEY_BASE64", "test-key")
 
 	cfg, err := Load()
 	if err != nil {
@@ -66,6 +67,9 @@ func TestLoadOverrides(t *testing.T) {
 	if cfg.RedisAddr != "redis:6379" {
 		t.Fatalf("RedisAddr = %q, want redis:6379", cfg.RedisAddr)
 	}
+	if cfg.MasterKeyBase64 != "test-key" {
+		t.Fatalf("MasterKeyBase64 = %q, want test-key", cfg.MasterKeyBase64)
+	}
 }
 
 func TestLoadRejectsInvalidLogLevel(t *testing.T) {
@@ -105,6 +109,7 @@ func clearConfigEnv(t *testing.T) {
 		"SUPABASE_JWT_SECRET",
 		"REDIS_ADDR",
 		"APP_SITE_URL",
+		"MASTER_KEY_BASE64",
 	} {
 		t.Setenv(key, "")
 	}