feat(F-004): typed fail-fast config and feature flag module

- loadConfig: pure over env object, accumulates all problems, names var names only
- DATABASE_URL now required at startup; PORT/HOST/LOG_LEVEL/NODE_ENV/REDIS_URL defaulted
- flags module behind FeatureFlagProvider; unknown flags OFF; runtime setEnabled (no redeploy)
- buildApp decorates app.flags; server.ts fail-fast before app boot
- tests caught and fixed flag-store case-normalization bug before gates
- zero new dependencies; all gates approved; verify.sh green

work/history.md

@@ -19,3 +19,10 @@
 - Entregable: request_id (generado o propagado-sanitizado), logs JSON correlacionados, error envelope v2 con requestId, hook de validación parseJson (zod), server con logging inyectable
 - Nota: doc stage rebotó a build para escribir README (project/ está gateado a build/implementer/running); comportamiento correcto del guardrail
 - Artefactos: work/artifacts/F-003/
+
+## 2026-08-14 — F-004 Typed config and feature flags — DONE
+- Gates: reviewer APPROVED, security APPROVED, qa APPROVED, verify.sh exit 0
+- Entregable: loadConfig fail-fast (DATABASE_URL requerido, errores solo con nombres de variables), módulo flags tras FeatureFlagProvider (default OFF, flip en runtime sin redeploy), app.flags decorado
+- Nota: los tests detectaron un bug real en build (case-normalization del store); corregido antes de gates con test de regresión
+- Cero dependencias nuevas
+- Artefactos: work/artifacts/F-004/