fix(security): resolve reviewer findings on secret key baking, host symlinks, and injection safety

- Prevent baking SECRET_KEY into Docker image during collectstatic
- Persist runtime SECRET_KEY in data/secret_key volume or read from environment
- Remove sed-based injection of CSRF_TRUSTED_ORIGINS in favor of native os.getenv
- Avoid overwriting system python3 symlink on SUSE; auto-detect python 3.10+ binaries
- Make /etc/hosts entry in installer idempotent
- Add security notice regarding compute node VNC/SPICE port firewall isolation

webvirtcloud/settings.py.template

@@ -17,7 +17,14 @@ from pathlib import Path
 # Build paths inside the project like this: BASE_DIR / 'subdir'.
 BASE_DIR = Path(__file__).resolve().parent.parent
 
-SECRET_KEY = ""
+SECRET_KEY = os.getenv("SECRET_KEY", "")
+if not SECRET_KEY:
+    secret_file = BASE_DIR / "data" / "secret_key"
+    if secret_file.exists():
+        try:
+            SECRET_KEY = secret_file.read_text().strip()
+        except Exception:
+            pass
 
 DEBUG = False