feat(auth): validate authentication configuration

[rd-code-23]

Summary

• add typed validation for Google OIDC, origins, session secrets, and session duration
• derive environment-specific cookie configuration from the approved security policy
• provide safe local placeholders in apps/api/.env.example
• add focused tests for valid, missing, malformed, and production configuration
• document the environment contract and file-purpose comment convention

Why

Authentication should fail fast when required configuration is missing or unsafe, without exposing secret values. This establishes a typed configuration boundary before session and OIDC middleware are implemented.

Validation

• pnpm --filter @goforlift/api test — 11 tests passed
• pnpm --filter @goforlift/api typecheck
• pnpm --filter @goforlift/api lint
• targeted Prettier checks
• git diff --check

Closes #5