Store Flask SECRET_KEY in database to fix multi-worker session handling

- Add secret_key column to server_config table
- Generate and store secret_key on first initialization
- Load secret_key from database at app startup for consistent sessions across workers
- Fix QR code generation: remove unsupported format parameter for PyPNG
- Fix race condition in database directory creation with exist_ok=True
- Add migration for existing databases to populate secret_key

src/controllers/admin_controller.py

@@ -89,7 +89,7 @@ def setup_admin_totp():
 
         # Convert QR code to base64
         buffer = io.BytesIO()
-        img.save(buffer, format='PNG')
+        img.save(buffer)  # PyPNG doesn't use format parameter
         qr_base64 = base64.b64encode(buffer.getvalue()).decode()
 
         return render_template('admin_setup_totp.html',
@@ -113,7 +113,7 @@ def setup_admin_totp():
         qr.make(fit=True)
         img = qr.make_image(fill_color="black", back_color="white")
         buffer = io.BytesIO()
-        img.save(buffer, format='PNG')
+        img.save(buffer)
         qr_base64 = base64.b64encode(buffer.getvalue()).decode()
 
         return render_template('admin_setup_totp.html',
@@ -137,7 +137,7 @@ def setup_admin_totp():
         qr.make(fit=True)
         img = qr.make_image(fill_color="black", back_color="white")
         buffer = io.BytesIO()
-        img.save(buffer, format='PNG')
+        img.save(buffer)
         qr_base64 = base64.b64encode(buffer.getvalue()).decode()
 
         return render_template('admin_setup_totp.html',
@@ -287,7 +287,7 @@ def generate_config_qr(server_address, server_port, client_key):
 
         # Convert to base64
         buffer = io.BytesIO()
-        img.save(buffer, format='PNG')
+        img.save(buffer)
         qr_base64 = base64.b64encode(buffer.getvalue()).decode()
 
         return qr_base64