Security: reject insecure default channel_secret, add input validation

[devin-ai-integration]

Summary

Both MeshCore_Dynamic_Interface and MeshCore_Channel_Interface previously shipped hardcoded default channel_secret values (all-zeros and c4d2b6c8254e3b11200f57e95dcb1197 respectively). Any node that omitted the config key silently used a publicly-known encryption key — traffic was effectively readable and injectable by anyone with the source code.

Changes:

• __init__ now raises ValueError at startup if channel_secret is missing, empty, or matches a known insecure default — the interface refuses to come online rather than silently running unencrypted:

_INSECURE_DEFAULTS = ("", "00000000000000000000000000000000", ...)
if self.channel_secret_hex.lower().strip() in _INSECURE_DEFAULTS:
    raise ValueError("...refusing to start. Set a unique 32-char hex secret...")

• Adds format + length validation (bytes.fromhex() + 16-byte check) so malformed secrets fail fast with a clear error instead of crashing later in set_channel().

• Enhances the SSL-disabled warning in MeshCore_Channel_Interface to explicitly mention MITM risk.

• Replaces hardcoded secret in docstring config examples with <your-32-hex-char-secret> placeholder.

Not a security issue (confirmed clean): no SQL, no eval/exec on user input, no exposed HTTP endpoints, no pickle deserialization, assembly buffers are TTL-bounded.

Link to Devin session: https://app.devin.ai/sessions/4bbb0eb40d024e8f9661e57de3075684
Requested by: @comms-engineer

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring