Generate a session secret instead of refusing to start

setup.sh starts the production server without SESSION_SECRET, so the new
"refuse to start" check stopped the app after an update. When the variable
is unset in production the server now makes a random secret once and keeps
it in DATA_DIR/.session-secret (mode 600, git-ignored).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

README.md

@@ -46,7 +46,7 @@ http://localhost:5173. Dev mode is much slower, so don't use it for real users.
 
 | Variable | What it turns on |
 | --- | --- |
-| `SESSION_SECRET` | **Required in production.** A long random string; the server refuses to start without it. |
+| `SESSION_SECRET` | A long random string that signs login cookies. Optional: if unset in production, the server makes one and keeps it in `DATA_DIR/.session-secret`. |
 | `ADMIN_EMAIL` | The one admin account. |
 | `ESV_API_KEY`, `API_BIBLE_KEY` | ESV, NLT, CSB and NASB in the Reader. |
 | `IQBIBLE_API_KEY` | IQ Bible: more commentaries, lexicons (BDB, LSJ, Abbott-Smith), places, topics, people, textual notes, Gospel parallels, daily verse and Spurgeon devotional, plan calendar export, more audio narrations, and background for podcast prompts. Hidden when unset. |