Change from $env/static/private to $env/dynamic/private for all
environment variables. This allows building in CI without embedding
secrets in build artifacts, while keeping secrets secure on the server
at runtime.
Changes:
- Refactor auth configuration to use dynamic env vars
- Move database connection string to runtime
- Update image API routes to read IMAGE_DIR at runtime
- Add .env.example for documentation
This enables the containerized build workflow to succeed without
requiring a .env file during build, as secrets are only needed when
the application starts on the server.
