Refactor configuration and remove production test seams

[jasonhedman]

Summary

• move environment validation to src/env.ts and simplify installation-secret and Blob authentication code
• colocate the vault Open Graph asset with the vault route
• remove mutable dependency bags, test-only factories, and injected defaults from production modules
• allow module mocking in test files and mock auth, database, connector, Blob, and Kernel boundaries directly
• document the production test-seam policy in AGENTS.md

Validation

• pnpm check
• DATABASE_URL=postgresql://build:build@127.0.0.1:5432/build BETTER_AUTH_URL=http://localhost:3000 pnpm build