feat: validate environment variables at startup with a typed config

[rubenhensen]

Closes #98.

Adds a single typed, validated source of truth for the server's environment config, so a missing/mistyped var fails fast at startup with one aggregated error instead of surfacing at first use.

What's added

• src/lib/server/config.ts — a zod schema parsed once at load. DATABASE_URL is required; YIVI_SERVER_URL/YIVI_SERVER_TOKEN/YIVI_DEMO_ATTRIBUTES and the eleven FF_* flags are coerced/defaulted. On failure it throws with every problem listed. Exports a typed config and the configSchema (for testing).
• Routed the consumers through it: db/index.ts (DATABASE_URL), auth/yivi.ts (YIVI_*, keeping its exported constants intact), and feature-flags.ts (FF_*).
• tests/unit/config.test.ts — covers defaults, boolean coercion, and the missing/empty DATABASE_URL rejection.

Deliberate scoping / safety

• No new required vars. Only DATABASE_URL is required — exactly what db/index.ts already enforced — so the Docker build (which sets a dummy DATABASE_URL) and CI are unaffected. YIVI_* stay optional with the same defaults as before.
• Boolean coercion preserves the old === 'true' semantics exactly (only the literal "true"; unset → false), so no flag silently flips.
• DB pool knobs stayed in db/index.ts via the existing intFromEnv (and its unit test from feat: configure explicit Postgres connection pool and timeouts #114) rather than moving them into config — avoids churning merged, tested code for no behavioural gain.

Verified: svelte-check clean, all 94 unit tests pass locally with no DATABASE_URL set (config-touching tests mock $env).

[dobby-coder]

On it, @rubenhensen! I'm starting my review of your PR now — I'll check the zod-based env config validation for correctness and rule-compliance and post a consolidated review shortly.

[dobby-coder]

Reviewed the typed env-config change. It's a clean, well-scoped refactor: a single zod-validated source of truth parsed once at startup, consumers routed through it, and the old === 'true' boolean semantics preserved exactly (case-sensitive; TRUE/unset → false). Tests cover defaults, coercion, and the required-DATABASE_URL rejection.

Verified locally: 94/94 unit tests pass, svelte-check is clean, and the prod build succeeds with a dummy DATABASE_URL. Build without DATABASE_URL fails, but main fails identically (the old db/index.ts threw the same) — pre-existing parity, not a regression, matching the PR's claim of no new required vars.

No rule-compliance issues found. One non-blocking nit below on the empty-string edge case for YIVI_SERVER_URL. Not blocking merge.

[dobby-coder]

Reviewed PR #121 — no rule violations found. I left one non-blocking nit: using .min(1) on YIVI_SERVER_URL means an explicitly empty string will throw at startup, which diverges from the old ?? default behavior and is asymmetric with YIVI_SERVER_TOKEN. Worth a quick look, but nothing blocking a merge.

Review comment