fix: review findings (async SQS dispatcher, backoff, batch insert, shutdown order, pagination, HMAC) + loadtest fixes; v0.1.6

internal/service/config/config.go

@@ -43,6 +43,9 @@ type Config struct {
 
 	// Безопасность
 	AuthTestMode bool
+	// JwtHMACSecret — если задан, JWT проверяется по HS256 (HMAC-SHA256).
+	// Пусто — структурная проверка (как раньше, периметр = платформа).
+	JwtHMACSecret string
 
 	// Логирование
 	LogLevel slog.Level
@@ -108,12 +111,13 @@ func Load() (*Config, error) {
 		SQSQueueName:         getEnv("SQS_QUEUE_NAME", DefaultSQSQueueName),
 		SQSRegion:            getEnv("SQS_REGION", DefaultSQSRegion),
 		SQSLongPollSeconds:   getEnvInt("SQS_LONG_POLL_SECONDS", 20),
-		SQSVisibilityTimeout: getEnvInt("SQS_VISIBILITY_TIMEOUT", 30),
+		SQSVisibilityTimeout: getEnvInt("SQS_VISIBILITY_TIMEOUT", 120),
 		MQTTUsername:         os.Getenv("MQTT_USERNAME"),
 		MQTTPassword:         os.Getenv("MQTT_PASSWORD"),
 		MQTTClientID:         getEnv("MQTT_CLIENT_ID", DefaultMQTTClientID),
 		AdminStatsToken:      os.Getenv("ADMIN_STATS_TOKEN"),
 		AuthTestMode:         getEnvBool("AUTH_TEST_MODE", false),
+		JwtHMACSecret:        os.Getenv("JWT_HMAC_SECRET"),
 		LogLevel:             parseLogLevel(os.Getenv("LOG_LEVEL"), slog.LevelInfo),
 	}
 
@@ -124,6 +128,9 @@ func Load() (*Config, error) {
 		port := getEnv("MQTT_PORT", DefaultMQTTPort)
 		path := getEnv("MQTT_WS_PATH", DefaultMQTTWSPath)
 		cfg.MQTTBrokerURL = "ws://" + host + ":" + port + path
+	} else if !strings.HasPrefix(cfg.MQTTBrokerURL, "ws://") &&
+		!strings.HasPrefix(cfg.MQTTBrokerURL, "wss://") {
+		return nil, fmt.Errorf("MQTT_BROKER_URL must start with ws:// or wss://, got %q", cfg.MQTTBrokerURL)
 	}
 
 	var missing []string