fail closed when PUBLIC_BUILD_ENV is unset

Origin validation, every rate limiter and the password-strength check each
treated an unset PUBLIC_BUILD_ENV as "relaxed", so a deployment that forgot the
variable silently ran with CORS reflecting any origin, no brute-force limit on
the sole account, and no password rules. setup.sh writes it, but .env.example
never mentioned it.

The three now share IS_DEV_BUILD, which is true only when PUBLIC_BUILD_ENV is
explicitly "dev" or "development". Anything else, including unset, is hardened.
Documented in .env.example.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/build-env.ts

@@ -0,0 +1,6 @@
+// Officer relaxes its guards (origin checks, rate limits, password rules) only when PUBLIC_BUILD_ENV
+// explicitly asks for it. Anything else — including an unset variable — gets the hardened path, so a
+// deployment that forgets to set it fails closed rather than silently opening up.
+const { PUBLIC_BUILD_ENV } = process.env;
+
+export const IS_DEV_BUILD = PUBLIC_BUILD_ENV === 'dev' || PUBLIC_BUILD_ENV === 'development';