Load .env.<APP_ENV>, validate config at boot, keep secrets out of the image

`main.go` only ever loaded `.env`; the `APP_ENV` switch described in
`.env.local` / `.env.production` did not exist, and a missing variable
surfaced one restart at a time as a log.Fatalf inside db.Connect.

config.Load now picks `.env.<APP_ENV>` (default local) then `.env`, with
real environment winning, reads every setting into one typed Config and
reports everything missing in one message. Production insists on a POS
signing secret; local warns when DB_HOST is not a local address. db,
redis and the image store take the Config instead of reading env
themselves.

Also:
- livehub read MQTT_USERNAME while everything else uses MQTT_USER, so the
  console stream connected to the broker unauthenticated. Both accepted.
- .dockerignore: `COPY . .` was baking .env.production into the image.
  Dockerfile sets APP_ENV=production.
- Drop utils/config.go (dead viper loader) and create_table.go (unused,
  hardcoded production DSN); go mod tidy removes viper.
- .env.example lists every variable the code reads; docs/ENVIRONMENT.md.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

db/redis.go

@@ -3,9 +3,7 @@ package db
 import (
 	"context"
 	"log"
-	"os"
-	"strconv"
-	"strings"
+	"nearle/config"
 	"time"
 
 	"github.com/redis/go-redis/v9"
@@ -31,23 +29,18 @@ var RedisCtx = context.Background()
 // Redis is optional here: without it the POS health board goes dark, but bills
 // still arrive and commit. That is the right failure — losing presence is an
 // inconvenience, losing a sale is not — so this never aborts startup.
-func InitRedis() {
-	host := strings.TrimSpace(os.Getenv("REDIS_HOST"))
-	if host == "" {
+func InitRedis(c config.RedisConfig) {
+	if !c.Enabled() {
 		log.Println("redis: REDIS_HOST not set, POS presence disabled")
 		return
 	}
 
-	port := getEnv("REDIS_PORT", "6379")
-	dbIndex, err := strconv.Atoi(getEnv("REDIS_DB", "0"))
-	if err != nil {
-		dbIndex = 0
-	}
+	host, port, dbIndex := c.Host, c.Port, c.DB
 
 	Rdb = redis.NewClient(&redis.Options{
 		Addr:     host + ":" + port,
-		Username: getEnv("REDIS_USER", "default"),
-		Password: os.Getenv("REDIS_PASSWORD"),
+		Username: c.User,
+		Password: c.Password,
 		DB:       dbIndex,
 
 		// Short on purpose. A degraded Redis must fail fast rather than tie up