docs: expand README with environment, security, and troubleshooting

[Faifor]

Motivation

• Improve onboarding by documenting prerequisites and explicit run/build commands for dev, stage, and prod environments.
• Make it clear where backend base URL and API prefix are configured so teams know how to map BACKEND_BASE_URL to the app runtime configuration.
• Provide security guidance and a troubleshooting playbook for common runtime issues (auth refresh/401, CORS, rate-limits, network errors) to reduce investigation time.

Description

• Updated README.md to add a Prerequisites section and concrete run examples using --dart-define (e.g. APP_ENV and API_BASE_URL) and sample flutter run/flutter build web commands.
• Documented where BACKEND_BASE_URL maps to API_BASE_URL and noted that the /api/v1 prefix should be provided in the API_BASE_URL value used at build/run time and referenced EnvConfig.load() / lib/core/config/env_config.dart.
• Added a step-by-step checklist for adding a new endpoint (DTO -> repo -> use case -> UI -> route -> test) with points where to place files and tests.
• Added a Security section covering token storage (in-memory TokenStorage vs web fallback risks), XSS mitigation, CSP recommendations, and token rotation / refresh flow behavior.
• Added a Troubleshooting section that lists checks and symptoms for 401/refresh loops, CORS failures, 429 rate-limits, and network/timeouts.

Testing

• Attempted to run unit tests locally with flutter test --reporter expanded, but the flutter binary was not available in the environment so the command failed (command not found).
• CI is configured to run flutter pub get and flutter test --reporter expanded via .github/workflows/ci.yml, so automated tests will execute in the CI environment for the PR.

---

Codex Task