feat(12-01): generate-secrets helper — SETUP-03 / D-05

- Add scripts/generate-secrets.mjs: plain ESM script that prints
  SESSION_SECRET + APP_PASSWORD_ENCRYPTION_KEY (32 random bytes each,
  hex-encoded) and VAPID_PUBLIC_KEY + VAPID_PRIVATE_KEY from web-push
  generateVAPIDKeys() — all to stdout only (SC-3: nothing written to disk)
- Resolve web-push as CommonJS default import from apps/api/node_modules
  (avoids a root-level dependency; named-export ESM form not supported)
- Wire root package.json "generate-secrets" script: node scripts/generate-secrets.mjs

package.json

@@ -13,7 +13,8 @@
     "typecheck": "pnpm -r typecheck",
     "format": "prettier --write .",
     "format:check": "prettier --check .",
-    "md:lint": "markdownlint-cli2"
+    "md:lint": "markdownlint-cli2",
+    "generate-secrets": "node scripts/generate-secrets.mjs"
   },
   "devDependencies": {
     "@eslint/js": "9.39.4",