build(backend): add express session secret into .env.example

[hwan513]

The secret needs to be changed when deploying for prod so it's actually a secret. Without a fixed secret the express session persistence acts funny.

Just adding this as a reminder for deployment.