Add centralized config validation with Zod, remove insecure JWT fallback

[AlonsoFi]

Closes: #34

Summary

• Add centralized src/config.ts module using Zod for env var validation at
  startup
• Remove insecure JWT_SECRET fallback ('change-me-in-production') from auth
  middleware
• Enforce JWT_SECRET minimum length of 16 characters and postgres:// scheme
  for DATABASE_URL
• Add SecretProvider interface for future secret store integrations
  (AWS/Vault)
• Replace scattered process.env reads in index.ts and auth.ts with
  frozen config singleton
• Fix package.json syntax errors (missing commas, duplicate script keys)

Test plan

• 9 new unit tests for config validation (all passing)
• 13 existing RBAC tests still pass
• Verify app refuses to start without required env vars
• Verify app refuses to start with JWT_SECRET < 16 chars
• Verify app starts normally with valid .env

[1nonlypiece]

@AlonsoFi Can you resolve the conflicts?