- Externalize CORS origins via app.cors-origins property (configurable per environment)
- Remove hardcoded JWT secret fallback; use env-var-only with safe test default
- Disable show-sql by default (enable only in dev profile)
- Create application-dev.yml with safe development defaults
- Add missing RouterLink import in MyMembershipsComponent (fixes runtime error)