fix(config): stop a trailing space in .env becoming part of the value

[clawedassistant26]

The bug

apps/pwa/src/config.mjs parses each .env line with:

/^\s*([A-Z0-9_]+)\s*=\s*(.*)\s*$/i

The trailing \s* is there to trim the value, but the greedy (.*) has already
eaten that whitespace by the time it runs, so nothing is ever trimmed.

One stray space at the end of a line, which is very easy to leave behind when
editing a .env by hand, ends up inside the value:

.env line	value exported
PUBLIC_ORIGIN=https://app.moshcode.sh	"https://app.moshcode.sh "
TELEGRAM_BOT_TOKEN=123:AAbb + tab	"123:AAbb\t"
RESEND_API_KEY="re_live_key"	"\"re_live_key\" "

Downstream that is silent and confusing:

• config.origin keeps the space, so every device link becomes
  https://app.moshcode.sh /device (/cli/device/code builds
  verification_uri and verification_uri_complete straight off it).
• A padded RESEND_API_KEY / TELEGRAM_BOT_TOKEN / DATABASE_AUTH_TOKEN is
  sent to the provider with the whitespace attached and just fails to
  authenticate, with nothing in the config to point at.
• The quote stripping below the regex is defeated too: KEY="value" no longer
  ends with a quote, so the value keeps its literal quotes.

Reproduced on unmodified main (dfcb8c1)

Writing apps/pwa/.env with PUBLIC_ORIGIN=https://app.moshcode.sh and
importing the real src/config.mjs:

origin:           "https://app.moshcode.sh "
verification_uri: "https://app.moshcode.sh /device"
resend.apiKey:    "\"re_live_key\" "
telegram.botToken: "123:AAbb\t"

No fault injection: the real module, the real loader, a normal .env file.

The fix

Make the value group lazy ((.*?)) so the trailing \s* can do the trim it
was written for. That is the whole behaviour change.

loadEnv also gains an optional file argument (defaulting to the same
apps/pwa/.env as before) and is exported, so the loader can be tested against
a throwaway file rather than the repo's own .env. Nothing else about the load
order changes: the environment still wins over the file.

Deliberately left alone: inline # comments are still part of the value, same
as before. That is a behaviour change, not a fix, so it is not in this PR.

Tests

New apps/pwa/test/config-env.test.mjs, 9 tests. It needs no PWA dependencies
(config.mjs is node builtins only), so it runs on a bare clone rather than
skipping.

Verified fail-before / pass-after by reverting only the regex character and
keeping the export, so the difference is the fix and not the import:

• unpatched: 4 fail / 5 pass (trailing space, trailing tab, quoted value
  with trailing space, and the mixed-lines case)
• patched: 9 pass / 0 fail

Full root suite npm test on this branch: 206 tests, 0 fail, 25 skipped
(PWA integration tests skip without apps/pwa deps installed). Baseline on
main is 197; the 9 added are the ones here.