fix(security): harden auth and secret handling (HH-444) (#101)

* fix(security): harden auth and credential handling (HH-444)

* fix(security): address HH-444 review blockers

* fix(security): close remaining HH-444 review blockers

---------

Co-authored-by: Rogee <rogee@ipao.vip>

backend/internal/handler/widget/widget_theme_handler.go

@@ -140,7 +140,7 @@ func (h *WidgetHandler) StageFileUpload(c *gin.Context) {
 
 	resp, err := h.widgetService.StageFileUpload(c.Request.Context(), req, fileReader)
 	if err != nil {
-		applogger.L().Errorf("Failed to stage file upload for website_token=%s: %v", websiteToken, err)
+		applogger.L().Errorf("Failed to stage widget file upload: %v", err)
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}