fix: JWT secret startup guard and order number advisory lock

H1: model_validator in Settings raises ValueError when jwt_secret_key is
    "changeme" and the process is running inside a container — fast-fail
    prevents insecure deployments; local dev outside Docker is unaffected.

H7: generate_order_number now acquires pg_advisory_xact_lock before SELECT MAX,
    matching the same pattern used in generate_invoice_number (billing/service.py).
    Concurrent order creation can no longer race to produce duplicate numbers.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/config.py

@@ -83,6 +83,15 @@ class Settings(BaseSettings):
         self.redis_url = _normalize_service_url(self.redis_url)
         return self
 
+    @model_validator(mode="after")
+    def reject_insecure_jwt_secret_in_production(self) -> "Settings":
+        if self.jwt_secret_key == "changeme" and _is_running_in_container():
+            raise ValueError(
+                "JWT_SECRET_KEY must be set to a secure random value in production. "
+                "The default 'changeme' key is not permitted when running inside a container."
+            )
+        return self
+
     # JWT
     jwt_secret_key: str = "changeme"
     jwt_algorithm: str = "HS256"