Load .env.<APP_ENV>, validate config at boot, keep secrets out of the image

`main.go` only ever loaded `.env`; the `APP_ENV` switch described in
`.env.local` / `.env.production` did not exist, and a missing variable
surfaced one restart at a time as a log.Fatalf inside db.Connect.

config.Load now picks `.env.<APP_ENV>` (default local) then `.env`, with
real environment winning, reads every setting into one typed Config and
reports everything missing in one message. Production insists on a POS
signing secret; local warns when DB_HOST is not a local address. db,
redis and the image store take the Config instead of reading env
themselves.

Also:
- livehub read MQTT_USERNAME while everything else uses MQTT_USER, so the
  console stream connected to the broker unauthenticated. Both accepted.
- .dockerignore: `COPY . .` was baking .env.production into the image.
  Dockerfile sets APP_ENV=production.
- Drop utils/config.go (dead viper loader) and create_table.go (unused,
  hardcoded production DSN); go mod tidy removes viper.
- .env.example lists every variable the code reads; docs/ENVIRONMENT.md.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scratch/productimages/main.go

@@ -27,9 +27,8 @@ import (
 	"log"
 	"strings"
 
+	"nearle/config"
 	"nearle/db"
-
-	"github.com/joho/godotenv"
 )
 
 type row struct {
@@ -44,8 +43,7 @@ func main() {
 	tenant := flag.Int("tenant", 0, "restrict to one tenant")
 	flag.Parse()
 
-	_ = godotenv.Load()
-	db.Connect()
+	db.Connect(config.MustLoad())
 
 	if db.ImageStore == nil {
 		log.Fatal("the image store is not configured (USE_S3 / S3_*), so there is nothing to list images from")