feat: centralize L402 config, automate Metal install, fix watchdog cleanup

- config.py: add L402_HMAC_SECRET, L402_MACAROON_SECRET, LIGHTNING_BACKEND
  to pydantic-settings with startup warnings for default secrets
- l402_proxy.py, mock_backend.py, factory.py: migrate from os.environ.get()
  to `from config import settings` per project convention
- Makefile: `make install-creative` now auto-installs PyTorch nightly with
  Metal (MPS) support on Apple Silicon instead of just printing a note
- activate_self_tdd.sh: add PID file (.watchdog.pid) and EXIT trap so
  Ctrl-C cleanly stops both the dashboard and the watchdog process
- .gitignore: add .watchdog.pid

https://claude.ai/code/session_01A81E5HMxZEPxzv2acNo35u

src/lightning/factory.py

@@ -12,6 +12,7 @@ import logging
 import os
 from typing import Optional
 
+from config import settings
 from lightning.base import LightningBackend
 
 logger = logging.getLogger(__name__)
@@ -68,7 +69,7 @@ def get_backend(name: Optional[str] = None) -> LightningBackend:
     """
     _register_backends()
     
-    backend_name = (name or os.environ.get("LIGHTNING_BACKEND", "mock")).lower()
+    backend_name = (name or settings.lightning_backend).lower()
     
     if backend_name not in _BACKENDS:
         available = ", ".join(_BACKENDS.keys())
@@ -100,8 +101,8 @@ def get_backend_info() -> dict:
     Returns:
         Dict with backend info for health/status endpoints
     """
-    backend_name = os.environ.get("LIGHTNING_BACKEND", "mock")
-    
+    backend_name = settings.lightning_backend
+
     return {
         "configured_backend": backend_name,
         "available_backends": list_backends(),

src/lightning/mock_backend.py

@@ -12,20 +12,13 @@ import secrets
 import time
 from typing import Optional
 
+from config import settings
 from lightning.base import Invoice, LightningBackend, LightningError
 
 logger = logging.getLogger(__name__)
 
-# Secret for HMAC-based invoice verification (mock mode)
-_HMAC_SECRET_DEFAULT = "timmy-sovereign-sats"
-_HMAC_SECRET_RAW = os.environ.get("L402_HMAC_SECRET", _HMAC_SECRET_DEFAULT)
-_HMAC_SECRET = _HMAC_SECRET_RAW.encode()
-
-if _HMAC_SECRET_RAW == _HMAC_SECRET_DEFAULT:
-    logger.warning(
-        "SEC: L402_HMAC_SECRET is using the default value — set a unique "
-        "secret in .env before deploying to production."
-    )
+# Read secret from centralised config (validated at startup in config.py)
+_HMAC_SECRET = settings.l402_hmac_secret.encode()
 
 
 class MockBackend(LightningBackend):