📝 docs: add comprehensive SOLID analysis and code review findings

- Documented SOLID principle violations across codebase
- Identified security best practice improvements needed
- Analyzed performance optimization opportunities
- Added detailed refactoring recommendations
- Updated ADR-0018 with JWT secret rotation reference
- Enabled gitea-client skill for programmer agent

This commit captures the current state analysis before implementing improvements.

pkg/config/config.go

@@ -20,6 +20,7 @@ type Config struct {
 	Logging   LoggingConfig   `mapstructure:"logging"`
 	Telemetry TelemetryConfig `mapstructure:"telemetry"`
 	API       APIConfig       `mapstructure:"api"`
+	Auth      AuthConfig      `mapstructure:"auth"`
 }
 
 // ServerConfig holds server-related configuration
@@ -54,6 +55,12 @@ type APIConfig struct {
 	V2Enabled bool `mapstructure:"v2_enabled"`
 }
 
+// AuthConfig holds authentication configuration
+type AuthConfig struct {
+	JWTSecret           string `mapstructure:"jwt_secret"`
+	AdminMasterPassword string `mapstructure:"admin_master_password"`
+}
+
 // VersionInfo holds application version information
 type VersionInfo struct {
 	Version   string `mapstructure:"-"` // Set via ldflags
@@ -104,6 +111,10 @@ func LoadConfig() (*Config, error) {
 	// API defaults
 	v.SetDefault("api.v2_enabled", false)
 
+	// Auth defaults
+	v.SetDefault("auth.jwt_secret", "default-secret-key-please-change-in-production")
+	v.SetDefault("auth.admin_master_password", "admin123")
+
 	// Check for custom config file path via environment variable
 	if configFile := os.Getenv("DLC_CONFIG_FILE"); configFile != "" {
 		v.SetConfigFile(configFile)
@@ -141,6 +152,10 @@ func LoadConfig() (*Config, error) {
 	v.BindEnv("telemetry.otlp_endpoint", "DLC_TELEMETRY_OTLP_ENDPOINT")
 	v.BindEnv("telemetry.service_name", "DLC_TELEMETRY_SERVICE_NAME")
 	v.BindEnv("telemetry.insecure", "DLC_TELEMETRY_INSECURE")
+
+	// Auth environment variables
+	v.BindEnv("auth.jwt_secret", "DLC_AUTH_JWT_SECRET")
+	v.BindEnv("auth.admin_master_password", "DLC_AUTH_ADMIN_MASTER_PASSWORD")
 	v.BindEnv("telemetry.sampler.type", "DLC_TELEMETRY_SAMPLER_TYPE")
 	v.BindEnv("telemetry.sampler.ratio", "DLC_TELEMETRY_SAMPLER_RATIO")
 
@@ -220,6 +235,16 @@ func (c *Config) GetV2Enabled() bool {
 	return c.API.V2Enabled
 }
 
+// GetJWTSecret returns the JWT secret
+func (c *Config) GetJWTSecret() string {
+	return c.Auth.JWTSecret
+}
+
+// GetAdminMasterPassword returns the admin master password
+func (c *Config) GetAdminMasterPassword() string {
+	return c.Auth.AdminMasterPassword
+}
+
 // GetLogLevel returns the logging level
 func (c *Config) GetLogLevel() string {
 	return c.Logging.Level