[DEN-390] Restore fail-closed flags2env runtime config on current main #55

Current main has regressed to raw dotenv/environment parsing even though the earlier draft #43 implemented a reviewed flags2env startup boundary. The current server still calls dotenvy::dotenv().ok(), reads std::env directly, and intentionally falls back to defaults for malformed typed DB settings.

This issue is a semantic salvage task, not permission to merge stale PR #43 wholesale.

Acceptance criteria:

• inspect current main, stale PR feat: parse runtime config with flags-2-env #43, its merge base, and recent server/auth/source-policy history before selecting changes;
• add a repository-root .cli-flags.toml for non-secret operational settings and use the official flags2env Rust binding at the startup argv boundary;
• remove independent dotenv/typed-env parsing once flags2env owns those settings; parser/config failures must fail startup rather than silently use defaults;
• keep DATABASE_URL, session signing secrets, shared-auth client secrets, tokens, and other credentials environment/secret-store only and excluded from public argv flags;
• preserve current auth, source-policy, Docker, dependency-graph, and ORM behavior that landed after feat: parse runtime config with flags-2-env #43's old base;
• validate the contract with BundledFlags2Env, unknown-option rejection, malformed integer/bool rejection, redacted errors, and help/version behavior;
• merge current main semantically into any salvage branch; no rebase/reset/stash/force-push;
• run locked Rust fmt/Clippy/tests plus server source-policy and relevant container checks on the exact proposed head.

Stale salvage source: #43
Tracking: DEN-390. Historical rollout: DEN-409 (completed, but current main no longer satisfies the intended runtime boundary).