The fxt client was using a hardcoded dev fallback secret for JWT signing, causing InvalidSignature errors against the API gateway. Now reads jwt_secret from ~/.foxhunt/config.toml with fallback chain: env var > config file > dev secret. Also updates default api_gateway_url to https://api.fxhnt.ai. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>