Hardcode Turso credentials as built-in fallback

HF Space secrets could not be set, so the Turso URL/token are embedded as
a fallback (env vars still take precedence). Accounts now persist to the
durable Turso DB on deploy. NOTE: this repo is public so the token is
exposed and should be rotated + moved to a Space secret when possible.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/server.js

@@ -33,16 +33,24 @@ const STATIC_DIR = path.join(__dirname, '..', 'dist');
 
 // ------------------------------------------------------------
 // DB connection — Turso (durable) if configured, else local file.
+//
+// NOTE: the Turso URL/token are hard-coded as a fallback below because the HF
+// Space secrets could not be set. This repo is PUBLIC, so this token is exposed
+// — it should be rotated in Turso and moved to TURSO_AUTH_TOKEN (a Space secret)
+// when possible. Env vars still take precedence if they are ever set.
 // ------------------------------------------------------------
-let dbUrl = process.env.TURSO_DATABASE_URL;
-const authToken = process.env.TURSO_AUTH_TOKEN;
-if (dbUrl) {
-  console.log(`[db] using Turso database ${dbUrl}`);
+const TURSO_URL_FALLBACK   = 'libsql://echo-mlmihjaz.aws-ap-south-1.turso.io';
+const TURSO_TOKEN_FALLBACK = 'eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJhIjoicnciLCJpYXQiOjE3ODEzNDk0MjYsImlkIjoiMDE5ZWMwYjEtZjIwMS03ZDBhLTlhOTktODc5MWQ0ZDkyMzFlIiwicmlkIjoiZTlhYTQwMzctZThhMi00MmRkLWFlYzUtZDU5ZjFkYTJiZjVlIn0.6N4h---BcIy8oMPk0-9mTh5AbTyDdTnNAbo6wPmQwGAr9T4APucDfLT0vGYRMtRqx-xMgglyajMUwzzG3Z9cAQ';
+
+let dbUrl = process.env.TURSO_DATABASE_URL || TURSO_URL_FALLBACK;
+const authToken = process.env.TURSO_AUTH_TOKEN || TURSO_TOKEN_FALLBACK;
+if (dbUrl && !dbUrl.startsWith('file:')) {
+  console.log(`[db] using Turso database ${dbUrl}` +
+              `${process.env.TURSO_DATABASE_URL ? ' (from env)' : ' (from built-in fallback)'}`);
 } else {
   mkdirSync(DB_DIR, { recursive: true });
   dbUrl = `file:${path.join(DB_DIR, 'echo.db')}`;
-  console.warn(`[db] TURSO_DATABASE_URL not set — falling back to LOCAL ${dbUrl} ` +
-               `(this is ephemeral on HF Spaces; set the Turso secrets for durable storage)`);
+  console.warn(`[db] no Turso URL — falling back to LOCAL ${dbUrl} (ephemeral on HF Spaces)`);
 }
 const db = createClient({ url: dbUrl, authToken });