security: fix P2.2 fail-open signature validation

ober

f20f81e9be55a6660e378ef4f8e09dad77320ff7

diff --git a/edge.ss b/edge.ss
index 33c7fac..44b44db 100644
--- a/edge.ss
+++ b/edge.ss
@@ -151,8 +151,12 @@
       (string=? host "::1")
       (string=? host "localhost")))
 
+;; P2.2: Hardened secret validation — empty secrets are never valid.
+;; A valid secret must be 32-4096 UTF-8 bytes of printable non-space ASCII.
 (def (valid-secret? secret)
   (and (string? secret)
+       ;; Explicitly reject empty strings
+       (> (string-length secret) 0)
        (>= (bytevector-length (string->utf8 secret)) 32)
        (<= (bytevector-length (string->utf8 secret)) 4096)
        (let ([bytes (string->utf8 secret)])