feat: missing required setting fails startup with a field-specific error (E00-S04-T02)

- packages/config: add src/startup.ts exposing assertValidConfig (builds on
  the T01 TypeBox/Ajv schema) and the field-specific startup errors
  (MissingRequiredSettingError names the missing field; ConfigStartupError
  names each violating field); re-export from the package boundary
- apps/server: validate the startup configuration (including the required
  EPPP_SESSION_SECRET) before the server binds, so a missing required
  setting crashes the process at startup naming the field; depends on
  @personal-blog/config
- compose.yaml: provide EPPP_SESSION_SECRET for the app service (dev-only
  >= 32 char default; override via .env / shell)
- Dockerfile: ship the compiled packages/config in the image (build source +
  runtime dist), matching the server's new workspace dependency
- pnpm-lock.yaml: apps/server importer gains @personal-blog/config

packages/config/src/index.ts

@@ -3,12 +3,20 @@
  *
  * [E00-S04-T01] TypeBox/Ajv schema: the package boundary exposes the
  * configuration schema (`configSchema`, defined with TypeBox) and the Ajv
- * schema-validation entry point (`validateConfig`). The environment adapter
- * (E00-S04-T04), field-specific startup errors (E00-S04-T02) and secret
- * redaction (E00-S04-T03) build on this boundary in later tasks.
+ * schema-validation entry point (`validateConfig`).
+ *
+ * [E00-S04-T02] Field-specific startup error: the boundary also exposes the
+ * startup validation entry point (`assertValidConfig`) and its field-specific
+ * errors (`MissingRequiredSettingError` — names the missing required setting —
+ * and `ConfigStartupError` — names each violating field), so the application
+ * fails fast at startup when a required setting is missing.
+ *
+ * The environment adapter (E00-S04-T04) and secret redaction (E00-S04-T03)
+ * build on this boundary in later tasks.
  */
 
 export { configSchema } from './schema.js';
 export type { Config } from './schema.js';
 export { validateConfig } from './validate.js';
 export type { ConfigValidationResult } from './validate.js';
+export { assertValidConfig, ConfigStartupError, MissingRequiredSettingError } from './startup.js';