feat(release): prepare 1.1.0 candidate

scripts/deploy-nas.sh

@@ -6,6 +6,36 @@
 
 set -e
 
+: "${JWT_SECRET:?JWT_SECRET is required}"
+: "${JWT_ISSUER:?JWT_ISSUER is required}"
+: "${JWT_AUDIENCE:?JWT_AUDIENCE is required}"
+: "${ADMIN_BOOTSTRAP_TOKEN:?ADMIN_BOOTSTRAP_TOKEN is required}"
+: "${D3RO_API_TOKEN:?D3RO_API_TOKEN is required}"
+: "${ADMIN_SESSION_SECRET:?ADMIN_SESSION_SECRET is required}"
+: "${API_SERVER_URL:?API_SERVER_URL is required}"
+: "${CORS_ALLOWED_ORIGINS:?CORS_ALLOWED_ORIGINS is required}"
+: "${ALLOWED_HOSTS:?ALLOWED_HOSTS is required}"
+
+for value in \
+  "$JWT_SECRET" \
+  "$JWT_ISSUER" \
+  "$JWT_AUDIENCE" \
+  "$ADMIN_BOOTSTRAP_TOKEN" \
+  "$D3RO_API_TOKEN" \
+  "$ADMIN_SESSION_SECRET" \
+  "$API_SERVER_URL" \
+  "$CORS_ALLOWED_ORIGINS" \
+  "$ALLOWED_HOSTS"; do
+  case "$value" in
+    *$'\n'*|*$'\r'*) echo "Deployment values must be single-line" >&2; exit 1 ;;
+  esac
+done
+
+if [ "${#D3RO_API_TOKEN}" -lt 32 ]; then
+  echo "D3RO_API_TOKEN must contain at least 32 characters" >&2
+  exit 1
+fi
+
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
@@ -44,9 +74,18 @@ chmod +x "$OUT_DIR/nas-control.sh"
 cat <<EOF > "$OUT_DIR/.env"
 PORT=$PORT
 DATA_PATH=./data
-JWT_SECRET=D3ROVoice_Super_Secure_Secret_Key_2026_Key!
+JWT_SECRET=$JWT_SECRET
+JWT_ISSUER=$JWT_ISSUER
+JWT_AUDIENCE=$JWT_AUDIENCE
+ADMIN_BOOTSTRAP_TOKEN=$ADMIN_BOOTSTRAP_TOKEN
+D3RO_API_TOKEN=$D3RO_API_TOKEN
+ADMIN_SESSION_SECRET=$ADMIN_SESSION_SECRET
+API_SERVER_URL=$API_SERVER_URL
+CORS_ALLOWED_ORIGINS=$CORS_ALLOWED_ORIGINS
+ALLOWED_HOSTS=$ALLOWED_HOSTS
 TZ=Asia/Seoul
 EOF
+chmod 600 "$OUT_DIR/.env"
 
 cat <<EOF > "$OUT_DIR/README.txt"
 ========================================================================