Add --channel-key flag to generate command

- stegasoo generate --channel-key now outputs a 256-bit hex key
- Also added .env.example template for Web UI configuration

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.gitignore

@@ -54,7 +54,7 @@ htmlcov/
 
 # Environment
 .env
-.env.*
+.env.local
 *.log
 
 # Distribution

frontends/web/.env.example

@@ -0,0 +1,15 @@
+# Stegasoo Web UI Configuration
+# Copy this file to .env and customize
+
+# Authentication (v4.0.2+)
+STEGASOO_AUTH_ENABLED=true
+STEGASOO_HTTPS_ENABLED=false
+STEGASOO_HOSTNAME=localhost
+
+# Channel Key (256-bit hex for private channel isolation)
+# Generate with: python -c "import secrets; print(secrets.token_hex(32))"
+# Leave empty for public mode
+STEGASOO_CHANNEL_KEY=
+
+# Flask settings
+FLASK_ENV=production

src/stegasoo/cli.py

@@ -398,16 +398,21 @@ def batch_check(ctx, images, recursive):
 @click.option(
     "--pin-length", default=DEFAULT_PIN_LENGTH, help=f"PIN length (default: {DEFAULT_PIN_LENGTH})"
 )
+@click.option(
+    "--channel-key", is_flag=True, help="Also generate a 256-bit channel key"
+)
 @click.pass_context
-def generate(ctx, words, pin_length):
+def generate(ctx, words, pin_length, channel_key):
     """
-    Generate random credentials (passphrase + PIN).
+    Generate random credentials (passphrase + PIN + optional channel key).
 
     Examples:
 
         stegasoo generate
 
         stegasoo generate --words 6 --pin-length 8
+
+        stegasoo generate --channel-key
     """
     import secrets
 
@@ -451,11 +456,17 @@ def generate(ctx, words, pin_length):
         "pin_length": pin_length,
     }
 
+    # Generate channel key if requested
+    if channel_key:
+        result["channel_key"] = secrets.token_hex(32)
+
     if ctx.obj.get("json"):
         click.echo(json.dumps(result, indent=2))
     else:
         click.echo(f"Passphrase:   {passphrase}")
         click.echo(f"PIN:          {pin}")
+        if channel_key:
+            click.echo(f"Channel Key:  {result['channel_key']}")
         click.echo("\n⚠️  Save these credentials securely - they cannot be recovered!")