feat(F-004): typed fail-fast config and feature flag module

- loadConfig: pure over env object, accumulates all problems, names var names only
- DATABASE_URL now required at startup; PORT/HOST/LOG_LEVEL/NODE_ENV/REDIS_URL defaulted
- flags module behind FeatureFlagProvider; unknown flags OFF; runtime setEnabled (no redeploy)
- buildApp decorates app.flags; server.ts fail-fast before app boot
- tests caught and fixed flag-store case-normalization bug before gates
- zero new dependencies; all gates approved; verify.sh green

work/artifacts/F-004/qa.json

@@ -0,0 +1,35 @@
+{
+  "feature_id": "F-004",
+  "agent": "qa",
+  "verdict": "APPROVED",
+  "summary": "All 4 acceptance criteria verified with fresh executions (live process + fresh test runs).",
+  "traceability": [
+    {
+      "criterion": "AC1: missing required env var -> startup fails with clear message",
+      "test": "fresh live run: env -u DATABASE_URL node dist/infrastructure/http/server.js",
+      "result": "PASS (prints 'Invalid configuration: - DATABASE_URL is required', exit code 1)"
+    },
+    {
+      "criterion": "AC2: flag off -> guarded path skipped",
+      "test": "feature-flag-store.test.ts 'skips a guarded path when the flag is off' + config-flags.test.ts",
+      "result": "PASS"
+    },
+    {
+      "criterion": "AC3: flag state change does not require redeploy",
+      "test": "'flips state at runtime without a new store' + composition 'runs once enabled at runtime' on the SAME app instance",
+      "result": "PASS"
+    },
+    {
+      "criterion": "AC4: verify.sh green",
+      "test": "./scripts/verify.sh",
+      "result": "PASS (exit 0)"
+    }
+  ],
+  "regressions": "PASS - full unit suite 38 passed | 6 skipped; F-002 integration 6 passed; /health returns 200 under valid config",
+  "evidence": [
+    "fresh live fail-fast run (exit 1, clear message naming DATABASE_URL)",
+    "fresh vitest run of flags unit + composition tests: 7 passed",
+    "./scripts/verify.sh exit 0"
+  ],
+  "timestamp": "2026-08-14T20:28:00Z"
+}