feat(F-004): typed fail-fast config and feature flag module

- loadConfig: pure over env object, accumulates all problems, names var names only
- DATABASE_URL now required at startup; PORT/HOST/LOG_LEVEL/NODE_ENV/REDIS_URL defaulted
- flags module behind FeatureFlagProvider; unknown flags OFF; runtime setEnabled (no redeploy)
- buildApp decorates app.flags; server.ts fail-fast before app boot
- tests caught and fixed flag-store case-normalization bug before gates
- zero new dependencies; all gates approved; verify.sh green

backlog/features.json

@@ -159,12 +159,12 @@
         "Flag state change does not require redeploy",
         "verify.sh green"
       ],
-      "status": "pending",
+      "status": "done",
       "created_at": "2026-08-14",
       "gates": {
-        "review": false,
-        "security": false,
-        "qa": false
+        "review": true,
+        "security": true,
+        "qa": true
       }
     },
     {