fix(security): harden self-hosted SECRET_KEY bootstrap (#36049)

Co-authored-by: EndlessLucky <66432853+EndlessLucky@users.noreply.github.com>

api/extensions/ext_set_secretkey.py

@@ -1,6 +1,13 @@
 from configs import dify_config
+from configs.secret_key import resolve_secret_key
 from dify_app import DifyApp
 
 
-def init_app(app: DifyApp):
-    app.secret_key = dify_config.SECRET_KEY
+def init_app(app: DifyApp) -> None:
+    """Resolve SECRET_KEY after config loading and before session/login setup."""
+    secret_key = dify_config.SECRET_KEY
+    if not secret_key:
+        secret_key = resolve_secret_key(secret_key)
+    dify_config.SECRET_KEY = secret_key
+    app.config["SECRET_KEY"] = secret_key
+    app.secret_key = secret_key