fix(security): remediate telecom compliance findings

backend/app/main.py

@@ -2,7 +2,7 @@ from contextlib import asynccontextmanager
 from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 from sqlalchemy import select
-from app.config import settings
+from app.config import settings, validate_security_settings
 from app.database import engine, Base, async_session
 from app.api import router as api_router
 from app.api import auth, users, customers, visits, work_plans, mini_business, key_visits
@@ -14,6 +14,7 @@ from app.services.scheduler_manager import start_scheduler, shutdown_scheduler
 
 @asynccontextmanager
 async def lifespan(app: FastAPI):
+    validate_security_settings()
     # Startup: create tables if not exists (for dev convenience)
     async with engine.begin() as conn:
         await conn.run_sync(Base.metadata.create_all)