Self-packaging #7: 12-factor env-var hardening (FLAPI_CONFIG + FLAPI_LOG_LEVEL)

[jrosskopf]

Part of epic #40. Independent — can land any time.

Goal

A bundled single-binary deploy needs to be configurable purely via
environment variables (the
12-factor app contract). Close two known
gaps so FLAPI_CONFIG and FLAPI_LOG_LEVEL work as documented (and,
in FLAPI_CONFIG's case, they're already documented but not
wired).

Scope

In src/main.cpp:269-304, add env-var fallback for two flags.
Precedence: CLI flag > env var > config file > built-in default.

FLAPI_CONFIG

• Read as a fallback for --config / -c.
• Default remains flapi.yaml.
• When a bundle is present, the embedded flapi.yaml is the implicit
  default; FLAPI_CONFIG can still point at a sidecar file outside
  the bundle (useful for ops overrides — bundled defaults + sidecar
  prod overrides).

FLAPI_LOG_LEVEL

• Read as a fallback for --log-level.
• Same precedence rule.
• Invalid value → error message + non-zero exit (no silent fallback).

Red tests

test/cpp/main_env_var_test.cpp (a small helper module + Catch2
tests):

1. CLI flag wins over env var.
2. Env var wins over default when no CLI flag is given.
3. Invalid FLAPI_LOG_LEVEL → error + non-zero exit.
4. FLAPI_CONFIG pointing at a missing file → error message names
   the path.

Plus a small integration assertion in test_self_packaging.py that
FLAPI_LOG_LEVEL=debug ./flapi-prod produces debug-level log output.

Green criteria

• All red tests pass.
• make integration-test still green.
• docs/CLI_REFERENCE.md documents the precedence.
• docs/CONFIG_REFERENCE.md gets a "12-factor checklist" section
  noting which env vars are read at startup vs. by DuckDB at query
  time (the AWS_/GOOGLE_/AZURE_* family already documented
  elsewhere).

Files

• Modified: src/main.cpp, docs/CLI_REFERENCE.md,
  docs/CONFIG_REFERENCE.md
• New: test/cpp/main_env_var_test.cpp (or extend an existing
  main-startup test if one exists)

Out of scope (deferred to a follow-up)

• FLAPI_PORT / FLAPI_HOST — would need careful precedence
  thinking against --port and the config file's server.port /
  server.host. Deferred by user.
• Full credential env-var audit. Deferred by user.