fix: fail closed for invalid NODE_ENV values

[tuzuminami]

Summary

• reject explicit NODE_ENV values outside development, test, and production
• prevent typo values from silently selecting development auth and storage
• add regression coverage for prod, Production, and empty values

Verification

• pnpm run build
• node --test dist/tests/server.test.js

Closes #25