refactor(config): centralize environment access behind typed configuration

[s6pa1rta3n-lab]

Fixes #236

Summary

Centralizes environment access behind a dedicated, typed configuration package (@sub-rosa/config) and enforces repository-wide hygiene via a static architecture guard (scripts/check-direct-env-access.mjs).

Core Deliverables

• @sub-rosa/config Package:
  • Typed environment readers with bounds checking and schema defaults (readString, readBoolean, readInteger, readNumber, readUrl, readEnum, readStellarPublicKey, readStellarContractId, readStellarSecretKey, readSecret, readBrowserPublic).
  • SecretValue container preventing secrets from leaking into logs, JSON representations, or error traces.
  • defineSchema helper for composing immutable, frozen configuration records.
  • Dedicated bootstrap adapters (getSystemEnv for Node.js, getBrowserEnv for browser/Vite).
• Architecture Guard & CI:
  • scripts/check-direct-env-access.mjs scanner preventing direct process.env or import.meta.env access outside approved bootstrap adapters.
  • Added config:guard and config:guard:test scripts to root package.json.
• System-wide Migration:
  • Migrated packages/sdk, services/appraisal-api, services/keeper, services/agent, services/auction-template, services/drand-tools, services/receipt-cli, apps/web, and repository scripts.
  • 100% tests passing across all workspaces.
  • 93.84% line coverage for @sub-rosa/config (weighted aggregate 80.43% vs. 70.00% threshold).

Stipulations Checklist

• Dedicated workspace package @sub-rosa/config with strict TS typing
• Typed readers with validated error handling (readString, readBoolean, readInteger, readNumber, readUrl, readEnum, readStellarPublicKey, readStellarContractId, readStellarSecretKey, readSecret, readBrowserPublic)
• Sensitive value wrapper SecretValue redacting secrets from logs, JSON serialization, and error messages
• Declarative immutable configuration schemas with defineSchema
• Single approved Node.js environment bootstrap adapter (getSystemEnv)
• Single approved browser/Vite environment bootstrap adapter (getBrowserEnv)
• Migration across all packages, services, apps, and scripts away from unvetted direct process.env / import.meta.env
• Repository static guard (scripts/check-direct-env-access.mjs) preventing regression and direct environment access
• Full test suite (100% tests passing, 93.8% line coverage on @sub-rosa/config, zero build/typecheck errors)

Payout Routing

• EVM (Base/Arbitrum/Polygon/ETH): 0xF46C9F6d70C50BF81ef3588AB523a90a594a2F89
• Stellar: GCL6OXAMLD75BMTINA6EMRUDWK5THQUSHMYNLSNBCJAPZJHNYJTUNIBC