fix(dev): make the documented local quick start work

[TaprootFreak]

Problem

The quick start documented in the README fails on a clean checkout:

cp .env.local.example .env
docker compose up -d
npm run setup

Configuration requires REALUNIT_W2W_GAS_LOW_BALANCE_THRESHOLD and throws when it is unset.
The variable is absent from .env.local.example and is not generated by scripts/setup.js,
so the API compiles cleanly (Found 0 errors) and then dies during boot:

Error: Missing REALUNIT_W2W_GAS_LOW_BALANCE_THRESHOLD
    at Configuration.<instance_members_initializer> (src/config/config.ts:1173:9)

.env.example:342 already carries the variable with the same value — only the local template
was missed when the guard was introduced.

Change

One entry in .env.local.example, with a comment explaining why the value is inert locally:
assertW2wGasWalletFunded() (src/subdomains/supporting/realunit/realunit.service.ts:3234)
rejects while REALUNIT_W2W_GAS_WALLET_PRIVATE_KEY / _ADDRESS are unset, before the
threshold is ever compared. So locally the value only has to satisfy the boot check.

Scope

An earlier revision of this branch also made scripts/setup.js load .env, so that a
customised SQL_* would apply to the script's own database checks. That was dropped again:

• The safety check allows remote hosts (/^sql-dfx-api-loc/i,
  /loc.*\.database\.windows\.net/i), while dbConfig() previously never saw SQL_HOST and
  therefore always operated on localhost. Reading .env would have let setAdminRole() and
  seedDepositAddresses() write to a remote database for the first time.
• It would only have solved half the problem: docker-compose.yml and the script's API_URL
  keep their hard-coded values and would still ignore a customised .env.
• dotenv is not a direct dependency of this package.

Making the local setup genuinely configurable needs the compose file, the API URL and a
tightened host allow-list changed together. This pull request stays on the single defect that
blocks every developer.

Verification

• Before: boot crash with the error above.
• After: npm run setup completes end to end — database ready, admin registered and promoted,
  5 deposit addresses seeded; GET /v1/asset returns 200 against the seeded database
  (229 assets, 250 countries, 24 fiats).
• npm run format:check passes. The changed path is outside the lint and format globs
  ({src,apps,libs,test}).

[TaprootFreak]

Completed 3 review passes before this reached zero findings.

Pass 1 removed a second change that had been bundled in: making scripts/setup.js load .env. The host allow-list in that script accepts remote hosts, while dbConfig() previously never saw SQL_HOST and therefore always operated on localhost — loading .env would have let the admin-role and deposit-seeding steps write to a remote database for the first time. It also only solved half the problem, since the compose file and the script's API URL stay hard-coded. That belongs in its own change.

Pass 1 also corrected the justification in the comment: DISABLED_PROCESSES=* only suppresses cron processes, while the threshold is evaluated in the HTTP path. The actual reason the value is inert locally is that assertW2wGasWalletFunded() rejects while the W2W wallet credentials are unset.

Pass 2 tightened the same comment to say the threshold is compared rather than read after the credential check — it is destructured before it.

Pass 3 came back clean on both dimensions. Final diff is 7 lines in one file.