feat(F-004): typed fail-fast config and feature flag module

- loadConfig: pure over env object, accumulates all problems, names var names only
- DATABASE_URL now required at startup; PORT/HOST/LOG_LEVEL/NODE_ENV/REDIS_URL defaulted
- flags module behind FeatureFlagProvider; unknown flags OFF; runtime setEnabled (no redeploy)
- buildApp decorates app.flags; server.ts fail-fast before app boot
- tests caught and fixed flag-store case-normalization bug before gates
- zero new dependencies; all gates approved; verify.sh green

work/artifacts/F-004/security.json

@@ -0,0 +1,22 @@
+{
+  "feature_id": "F-004",
+  "agent": "security",
+  "verdict": "APPROVED",
+  "summary": "Security gate passed. No new dependencies (0 vulnerabilities), no dangerous patterns, config errors name variable NAMES only (secret leakage structurally impossible), .env hygiene intact.",
+  "checks": {
+    "dependencies": "PASS: npm audit -> 0 vulnerabilities; ticket added zero dependencies by design",
+    "secret_leakage": "PASS: every problems.push uses var names/static text only; dedicated unit test asserts a secret in DATABASE_URL never appears in the thrown message",
+    "dangerous_patterns": "PASS: no eval / new Function / child_process in new code",
+    "env_hygiene": "PASS: .env gitignored; .env.example trackable and carries only dev-only/public values",
+    "input_surfaces": "PASS: PORT integer-range validated; FLAG_* parsed to booleans only (no string passthrough); unknown flags fail-safe OFF so risky paths stay skipped"
+  },
+  "findings": [],
+  "evidence": [
+    "npm audit -> found 0 vulnerabilities",
+    "grep eval|new Function|child_process over config+flags -> none",
+    "grep problems.push -> name-only messages (4 sites inspected)",
+    "git check-ignore .env -> ignored; .env.example -> tracked",
+    "unit test 'never echoes secret values in error messages' passes"
+  ],
+  "timestamp": "2026-08-14T20:26:00Z"
+}