Reject invalid SOCIAL_TOKEN_ENCRYPTION_KEY instead of 500ing.

Placeholder Fernet values like replace-with-fernet-key now raise a clear SocialCryptoError in the portal, and prod env examples no longer ship a fake key.

.env.prod.example

@@ -77,7 +77,10 @@ PCM_RETURN_ADDRESS='{"firstName":"Monica","lastName":"Dhillon","address":"replac
 # LinkedIn Auth redirect (prod): https://YOUR_DOMAIN/portal/social/accounts/linkedin/callback/
 META_APP_ID=
 META_APP_SECRET=
-SOCIAL_TOKEN_ENCRYPTION_KEY=replace-with-fernet-key
+# Must be a real Fernet key (44 chars). Generate:
+#   python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+# Do NOT use a placeholder — invalid keys break LinkedIn/Meta token save.
+SOCIAL_TOKEN_ENCRYPTION_KEY=
 
 # Ollama for social drafting (reachable from app hosts)
 OLLAMA_BASE_URL=http://10.0.0.128:11434
@@ -116,7 +119,7 @@ GUNICORN_BIND=0.0.0.0:8000
 # EMAIL_HOST_PASSWORD=replace-me
 # SMTP2GO_SMS_API_KEY=replace-me
 # LOB_API_KEY=replace-me
-# SOCIAL_TOKEN_ENCRYPTION_KEY=replace-with-fernet-key
+# SOCIAL_TOKEN_ENCRYPTION_KEY=  # real Fernet.generate_key() output, not a placeholder
 # OLLAMA_BASE_URL=http://10.0.0.128:11434
 # NOMINATIM_BASE_URL=http://10.0.0.128:8089
 # NOMINATIM_COUNTRY_CODES=us