fix(v2): UX polish, spec compliance, type safety, race-condition fixes

- Auto-create WebhookToken for new users (first-user and admin-created),
  so setup wizard step 3 immediately has a valid secret to display
- Setup wizard: load webhook secret on step 3 entry (not only on AWS save),
  so skipping AWS setup still shows correct webhook info
- Admin panel: add Edit modal with username and password change for any user
  (spec: 'Edit username or password of any user')
- Webhook handler: only post 'no config' comment on opened/reopened actions,
  not on synchronize or closed — prevents spam on sync events
- deploy.ts: clear stale abort signal at start of runDeploy so a signal meant
  to cancel the previous job cannot accidentally abort the new one
- routes/auth.ts: fix sameSite cookie case to lowercase 'lax' per TypeScript
- Add node-cron type declaration to silence TS7016 for that import
- SPEC.md: fix ec2:ImportKeyPair → ec2:CreateKeyPair (code uses CreateKeyPair)
- example.env: improve comments, add NODE_ENV, add key generation hints

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

example.env

@@ -1,17 +1,20 @@
-# PP (PR Previews) - Environment Variables
-# Copy to .env and fill in values
+# PP (PR Previews) — Environment Variables
+# Copy to .env (for local dev) or set in docker-compose.yml environment
 
 # PostgreSQL connection string
 DATABASE_URL=postgresql://pp:pp_password@localhost:5432/pp
 
 # Session signing secret (at least 32 random chars)
-SESSION_SECRET=change_me_to_a_random_32_character_string
+# Generate: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+SESSION_SECRET=change_me_to_a_long_random_string_at_least_32_chars
 
-# Public URL of this PP instance (no trailing slash)
+# Public URL of this PP instance (no trailing slash). Used in webhook URLs and PR comment links.
 PP_BASE_URL=https://pp.example.com
 
-# AES-256 encryption key — 64 hex chars (32 bytes)
-# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+# AES-256 encryption key — exactly 64 hex chars (32 bytes).
+# Used to encrypt Gitea PAT, AWS credentials, and SSH private keys at rest.
+# Generate: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+# WARNING: Changing this key will invalidate all encrypted data in the database.
 ENCRYPTION_KEY=0000000000000000000000000000000000000000000000000000000000000000
 
 # Backend port (default: 5000)
@@ -19,3 +22,6 @@ PORT=5000
 
 # Log level: trace | debug | info | warn | error
 LOG_LEVEL=info
+
+# Node environment
+NODE_ENV=production