feat: missing required setting fails startup with a field-specific error (E00-S04-T02)

- packages/config: add src/startup.ts exposing assertValidConfig (builds on
  the T01 TypeBox/Ajv schema) and the field-specific startup errors
  (MissingRequiredSettingError names the missing field; ConfigStartupError
  names each violating field); re-export from the package boundary
- apps/server: validate the startup configuration (including the required
  EPPP_SESSION_SECRET) before the server binds, so a missing required
  setting crashes the process at startup naming the field; depends on
  @personal-blog/config
- compose.yaml: provide EPPP_SESSION_SECRET for the app service (dev-only
  >= 32 char default; override via .env / shell)
- Dockerfile: ship the compiled packages/config in the image (build source +
  runtime dist), matching the server's new workspace dependency
- pnpm-lock.yaml: apps/server importer gains @personal-blog/config

apps/server/Dockerfile

@@ -21,14 +21,17 @@
 # T05 the runtime stage drops root privileges (runs as the image's non-root
 # `node` user).
 #
-# The app now depends on the `database-postgres` workspace package (the single
-# owner of the pg/Kysely driver, E00-S03-T02). The build stage therefore also
-# installs/builds that package — the server's `build`/`typecheck` scripts
-# build their workspace dependency first (`pnpm --filter
-# @personal-blog/database-postgres build`), and the runtime stage ships the
-# compiled `packages/database-postgres/dist` next to the copied workspace
-# node_modules links so the server's `@personal-blog/database-postgres` import
-# resolves at run time.
+# The app now depends on the `config` and `database-postgres` workspace
+# packages (the configuration service — E00-S04-T02 validates the required
+# settings at startup — and the single owner of the pg/Kysely driver,
+# E00-S03-T02). The build stage therefore also installs/builds those
+# packages — the server's `build`/`typecheck` scripts build their workspace
+# dependencies first (`pnpm --filter @personal-blog/config build` and
+# `pnpm --filter @personal-blog/database-postgres build`), and the runtime
+# stage ships the compiled `packages/config/dist` and
+# `packages/database-postgres/dist` next to the copied workspace node_modules
+# links so the server's `@personal-blog/config` and
+# `@personal-blog/database-postgres` imports resolve at run time.
 #
 # T08: the image embeds no secrets. The Dockerfile declares no secret-bearing
 # ARG/ENV instruction (the only ENV is `NODE_ENV=production`) and every COPY
@@ -68,10 +71,11 @@ COPY extensions/example/package.json extensions/example/package.json
 RUN pnpm install --frozen-lockfile
 
 # Compile the server package (tsc -p apps/server/tsconfig.json -> dist/). The
-# server's build script builds its workspace dependency first (the
-# `database-postgres` package, whose compiled dist the server imports), so a
-# single command produces both dists in the right order.
+# server's build script builds its workspace dependencies first (the `config`
+# and `database-postgres` packages, whose compiled dists the server imports),
+# so a single command produces all dists in the right order.
 COPY apps/server apps/server
+COPY packages/config packages/config
 COPY packages/database-postgres packages/database-postgres
 RUN pnpm --filter @personal-blog/server build
 
@@ -81,11 +85,13 @@ WORKDIR /app
 ENV NODE_ENV=production
 
 # The workspace install (devDependencies included — image-size pruning is a
-# later E00-S02 concern) plus the compiled server output, the compiled
-# database-postgres output the server imports, and the package manifests.
+# later E00-S02 concern) plus the compiled server output, the compiled config
+# and database-postgres outputs the server imports, and the package manifests.
 COPY --from=build /app/node_modules ./node_modules
 COPY --from=build /app/apps/server/dist ./apps/server/dist
 COPY --from=build /app/apps/server/package.json ./apps/server/package.json
+COPY --from=build /app/packages/config/dist ./packages/config/dist
+COPY --from=build /app/packages/config/package.json ./packages/config/package.json
 COPY --from=build /app/packages/database-postgres/dist ./packages/database-postgres/dist
 COPY --from=build /app/packages/database-postgres/package.json ./packages/database-postgres/package.json