papra: add required AUTH_SECRET (app refuses to boot without it)

papra was NOT version-bumped by this campaign -- it crash-looped at its existing
26.6.1-rootless pin, so this is a PRE-EXISTING catalog defect: papra has never
been deployable from this template.

  Invalid configuration: In production, the auth secret must not be the default
  one. Please set a secure auth secret using the AUTH_SECRET environment
  variable.

Added as a generated hex:32 secret and marked data_key: true -- it signs
sessions, so regenerating it on restore would invalidate every login.

Campaign 7 catalog sweep.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nn3VgQk9iwEGgyx6QJ2NvE

templates/papra/.felhom.yml

@@ -30,6 +30,17 @@ deploy_fields:
     default: "papra"
     required: true
     locked_after_deploy: true
+
+  - env_var: AUTH_SECRET
+    label: "Munkamenet-aláíró kulcs"
+    type: secret
+    generate: "hex:32"
+    locked_after_deploy: true
+    # A Papra éles módban ELUTASÍTJA az indulást, ha ez az alapértelmezett érték
+    # marad ("the auth secret must not be the default one"), ezért kötelező.
+    # Ez írja alá a munkameneteket: ha újragenerálódik, minden bejelentkezés
+    # érvénytelenné válik, ezért visszaállításkor a régi kulcsot kell megtartani.
+    data_key: true
     description: "Az alkalmazás aldomainje"
 
 # --- App info (info page content) ---

templates/papra/docker-compose.yml

@@ -14,6 +14,7 @@ services:
     environment:
       - TZ=Europe/Budapest
       - APP_BASE_URL=https://${SUBDOMAIN}.${DOMAIN}
+      - AUTH_SECRET=${AUTH_SECRET}
     volumes:
       - papra_data:/app/data
     networks: