Load .env.<APP_ENV>, validate config at boot, keep secrets out of the image

`main.go` only ever loaded `.env`; the `APP_ENV` switch described in
`.env.local` / `.env.production` did not exist, and a missing variable
surfaced one restart at a time as a log.Fatalf inside db.Connect.

config.Load now picks `.env.<APP_ENV>` (default local) then `.env`, with
real environment winning, reads every setting into one typed Config and
reports everything missing in one message. Production insists on a POS
signing secret; local warns when DB_HOST is not a local address. db,
redis and the image store take the Config instead of reading env
themselves.

Also:
- livehub read MQTT_USERNAME while everything else uses MQTT_USER, so the
  console stream connected to the broker unauthenticated. Both accepted.
- .dockerignore: `COPY . .` was baking .env.production into the image.
  Dockerfile sets APP_ENV=production.
- Drop utils/config.go (dead viper loader) and create_table.go (unused,
  hardcoded production DSN); go mod tidy removes viper.
- .env.example lists every variable the code reads; docs/ENVIRONMENT.md.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

db/connect.go

@@ -3,8 +3,8 @@ package db
 import (
 	"fmt"
 	"log"
+	"nearle/config"
 	"net/url"
-	"os"
 	"time"
 
 	"gorm.io/driver/postgres"
@@ -23,14 +23,18 @@ var (
 // DATABASE CONNECTION
 // --------------------
 
-func Connect() {
+// Connect opens the main database and then the optional catalogue database
+// and image store. Everything it needs has already been validated by
+// config.Load, so a missing variable can no longer surface here as a
+// log.Fatal halfway through boot.
+func Connect(cfg *config.Config) {
 	dsn := fmt.Sprintf(
 		"host=%s user=%s password=%s dbname=%s port=%s sslmode=disable TimeZone=Asia/Kolkata",
-		mustEnv("DB_HOST"),
-		mustEnv("DB_USER"),
-		mustEnv("DB_PASSWORD"),
-		mustEnv("DB_NAME"),
-		getEnv("DB_PORT", "5433"),
+		cfg.DB.Host,
+		cfg.DB.User,
+		cfg.DB.Password,
+		cfg.DB.Name,
+		cfg.DB.Port,
 	)
 
 	var err error
@@ -42,17 +46,16 @@ func Connect() {
 	setupDB(DB)
 	fmt.Println("✅ Database connected")
 
-	connectCatalogueDB()
-	connectImageStore()
+	connectCatalogueDB(cfg.Catalogue)
+	connectImageStore(cfg.S3)
 }
 
 // connectCatalogueDB opens the read-only connection to the catalogue
 // (pgvector) database. If its env vars are not set, catalogue endpoints
 // are simply unavailable — this must never block startup of the main app.
-func connectCatalogueDB() {
-	host := getEnv("CATALOGUE_DB_HOST", "")
-	if host == "" {
-		fmt.Println("⚠️  Catalogue DB env vars not set, skipping catalogue DB connection")
+func connectCatalogueDB(c config.DBConfig) {
+	if !c.Enabled() {
+		fmt.Println("⚠️  CATALOGUE_DB_HOST not set, skipping catalogue DB connection")
 		return
 	}
 
@@ -62,9 +65,9 @@ func connectCatalogueDB() {
 	// quoting/comment syntax.
 	dsnURL := url.URL{
 		Scheme: "postgres",
-		User:   url.UserPassword(mustEnv("CATALOGUE_DB_USER"), mustEnv("CATALOGUE_DB_PASSWORD")),
-		Host:   fmt.Sprintf("%s:%s", host, getEnv("CATALOGUE_DB_PORT", "5432")),
-		Path:   "/" + mustEnv("CATALOGUE_DB_NAME"),
+		User:   url.UserPassword(c.User, c.Password),
+		Host:   fmt.Sprintf("%s:%s", c.Host, c.Port),
+		Path:   "/" + c.Name,
 	}
 	q := dsnURL.Query()
 	q.Set("sslmode", "disable")
@@ -108,22 +111,3 @@ func CloseDB() {
 	}
 	fmt.Println("Connection closed Successfully")
 }
-
-// --------------------
-// ENV HELPERS
-// --------------------
-
-func mustEnv(key string) string {
-	val := os.Getenv(key)
-	if val == "" {
-		log.Fatalf("Missing required env variable: %s", key)
-	}
-	return val
-}
-
-func getEnv(key, fallback string) string {
-	if val := os.Getenv(key); val != "" {
-		return val
-	}
-	return fallback
-}

db/imagestore.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"log"
+	"nearle/config"
 	"sort"
 	"strings"
 	"sync"
@@ -33,23 +34,20 @@ var ImageStore *imageStore
 
 // connectImageStore wires up the DigitalOcean Spaces (S3-compatible) client
 // used to resolve catalogue product images. Like the catalogue DB, this must
-// never block or fail app startup — if S3 env vars are absent, image URLs
-// are simply omitted from catalogue responses.
-func connectImageStore() {
-	if getEnv("USE_S3", "") != "true" {
-		fmt.Println("⚠️  S3 not enabled, skipping image store")
+// never block or fail app startup — with USE_S3 unset, image URLs are simply
+// omitted from catalogue responses. (USE_S3=true with a key missing is caught
+// by config.Load before we get here.)
+func connectImageStore(c config.S3Config) {
+	if !c.Enabled {
+		fmt.Println("⚠️  USE_S3 not set, skipping image store")
 		return
 	}
 
-	endpoint := getEnv("S3_ENDPOINT", "")
-	bucket := getEnv("S3_BUCKET", "")
-	accessKey := getEnv("S3_ACCESS_KEY", "")
-	secretKey := getEnv("S3_SECRET_KEY", "")
-	region := getEnv("S3_REGION", "")
-	if endpoint == "" || bucket == "" || accessKey == "" || secretKey == "" {
-		fmt.Println("⚠️  S3 env vars incomplete, skipping image store")
-		return
-	}
+	endpoint := c.Endpoint
+	bucket := c.Bucket
+	accessKey := c.AccessKey
+	secretKey := c.SecretKey
+	region := c.Region
 
 	// S3_ENDPOINT is bucket-qualified (e.g. https://nearle.sgp1.digitaloceanspaces.com).
 	// The SDK's virtual-hosted-style client re-prepends the bucket to whatever

db/redis.go

@@ -3,9 +3,7 @@ package db
 import (
 	"context"
 	"log"
-	"os"
-	"strconv"
-	"strings"
+	"nearle/config"
 	"time"
 
 	"github.com/redis/go-redis/v9"
@@ -31,23 +29,18 @@ var RedisCtx = context.Background()
 // Redis is optional here: without it the POS health board goes dark, but bills
 // still arrive and commit. That is the right failure — losing presence is an
 // inconvenience, losing a sale is not — so this never aborts startup.
-func InitRedis() {
-	host := strings.TrimSpace(os.Getenv("REDIS_HOST"))
-	if host == "" {
+func InitRedis(c config.RedisConfig) {
+	if !c.Enabled() {
 		log.Println("redis: REDIS_HOST not set, POS presence disabled")
 		return
 	}
 
-	port := getEnv("REDIS_PORT", "6379")
-	dbIndex, err := strconv.Atoi(getEnv("REDIS_DB", "0"))
-	if err != nil {
-		dbIndex = 0
-	}
+	host, port, dbIndex := c.Host, c.Port, c.DB
 
 	Rdb = redis.NewClient(&redis.Options{
 		Addr:     host + ":" + port,
-		Username: getEnv("REDIS_USER", "default"),
-		Password: os.Getenv("REDIS_PASSWORD"),
+		Username: c.User,
+		Password: c.Password,
 		DB:       dbIndex,
 
 		// Short on purpose. A degraded Redis must fail fast rather than tie up