Fix enforced connection fields overridden by user env vars

[wch]

Connection env vars (ANTHROPIC_BASE_URL, AWS_REGION, POSITAI_AUTH_HOST, etc.) were applied as a post-merge overlay that landed above the POSIT_AI_PROVIDERS_ENFORCED layer. This meant a user's shell variable could silently override an admin-pinned connection value, defeating the enforced control.

The fix converts env vars from a post-resolution overlay into a resolver-owned config source ranked below enforced but above user/host/default. All precedence now flows through the single deepMerge in resolveProviderCatalog — enforced is merged last and always wins. The bespoke applyEnvOverlay function in build-catalog.ts is removed.

Fixes #10

Changes

• src/connection-env.ts (new) — owns CONNECTION_ENV_MAPPINGS and readEnvConnectionConfig(), extracted from build-catalog.ts.
• src/resolve-catalog.ts — private ConnectionEnvSource / RankedConfigSource types; RANK map with env at rank 1; env source synthesized from envVars, excluded from enablement layers.
• src/build-catalog.ts — removed applyEnvOverlay, readEnvSection, CONNECTION_ENV_MAPPINGS, and the options.envVars parameter from buildCatalog().
• Tests — three regression tests (enforced beats env scalar, env beats user/default, sub-key granularity); updated build-catalog-custom.test.ts to the new three-argument signature.
• Docs — README, aiConfig.md, and JSDoc updated to describe precedence as enforced > connection env > user > host > default.

Verification

// Before the fix, the env var wins — enforced is silently overridden:
resolveProviderCatalog({
  sources: [
    { kind: "enforced", config: { providers: { anthropic: { baseUrl: "https://enforced.example.com" } } } },
    { kind: "user", config: { providers: {} } },
  ],
  baseline: { defaultEnabled: true },
  envVars: { ANTHROPIC_BASE_URL: "https://env.example.com" },
});
// Before: anthropic.connection.baseUrl === "https://env.example.com"  ← bug
// After:  anthropic.connection.baseUrl === "https://enforced.example.com"  ← correct

[melissa-barca]

LGTM!