Add production configuration validation

[Subhransu-De]

What to build

Add a fail-fast production configuration validator so unsafe placeholder values cannot accidentally reach production.

Acceptance criteria

• Production mode is explicit through an environment setting.
• Production startup rejects placeholder secrets and obvious development values.
• Production startup rejects localhost-only OIDC/database settings unless explicitly allowed.
• Validator checks that required security-related settings are present.
• Tests cover valid production config and representative invalid configs.
• Docs explain how to satisfy the validator.

Blocked by

None - can start immediately.