Auth bypass when PROXLY_SECRET unset + secret transmitted in URL query string

[consigcody94]

Found via code audit. packages/server/src/auth.ts:3-7. validateSecret returns true when env var unset. Also secret extracted from URL query params - logged by proxies/CDNs.