Add centralized config validation with Zod, remove insecure JWT fallback

.env.example

@@ -1 +1,11 @@
+# ── Required ──────────────────────────────────────────
 DATABASE_URL=postgres://postgres:postgres@localhost:5432/disciplr
+JWT_SECRET=change-me-to-a-real-secret-at-least-16-chars
+
+# ── Optional (defaults shown) ────────────────────────
+PORT=3000
+NODE_ENV=development
+
+# ── Future secrets ────────────────────────────────────
+# STELLAR_SECRET_KEY=
+# EMAIL_API_KEY=

jest.config.ts

@@ -3,6 +3,7 @@ import type { Config } from 'jest'
 const config: Config = {
      preset: 'ts-jest/presets/default-esm',
      testEnvironment: 'node',
+     setupFiles: ['./src/tests/setup-env.ts'],
      extensionsToTreatAsEsm: ['.ts'],
      moduleNameMapper: {
           '^(\\.{1,2}/.*)\\.js$': '$1',

knexfile.cjs

@@ -1,6 +1,10 @@
 /**
  * Knex migration config for Disciplr backend.
  * Uses DATABASE_URL and a dedicated migrations directory.
+ *
+ * NOTE: This file reads process.env.DATABASE_URL directly instead of importing
+ * src/config.ts because the Knex CLI loads it as CommonJS outside the app runtime.
+ * The canonical validation of DATABASE_URL lives in src/config.ts (Zod schema).
  */
 module.exports = {
   client: 'pg',