Fix XSS, CSRF, input validation, and related security issues

config.py

@@ -1,10 +1,19 @@
 import os
+import logging
 
 SQLALCHEMY_DATABASE_URI = os.environ.get(
     "DATABASE_URL",
     "sqlite:///batteries.db",
 )
-SECRET_KEY = os.environ.get("SECRET_KEY", "dev-secret-change-in-prod")
+
+_secret_key = os.environ.get("SECRET_KEY")
+if not _secret_key:
+    logging.warning(
+        "SECRET_KEY not set — using insecure default. "
+        "Set SECRET_KEY env var before running in production."
+    )
+SECRET_KEY = _secret_key or "dev-secret-change-in-prod"
+
 SQLALCHEMY_TRACK_MODIFICATIONS = False
 
 # Home Assistant integration (all optional — app works normally when absent)