fix(config): treat an empty environment variable as unset

docker-compose.yml forwards its whitelist as "${NAME:-}", so a variable
the operator never set reaches the process as the empty string. Reads
written as a nullish fallback kept that string: the weather client built
an empty base URL and every geocode failed with ERR_INVALID_URL, and the
IP geo lookup requested a relative path.

Reads with a fallback now go through src/lib/env.ts (envValue, envOr,
envFlag), which treats empty and whitespace as unset. IP_GEO_LOOKUP_DISABLED
accepts 1, true, yes and on instead of only "1". A structural test refuses
a ?? fallback written directly against process.env anywhere in src/, and
the compose whitelist guard counts the helper's call shape as a read.

.env.production.example

@@ -476,8 +476,9 @@ API_TOKEN_HMAC_KEY="<openssl rand -hex 32>"
 # IP_GEO_LOOKUP_URL="http://ip-api.com/json"
 # IP_GEO_ALLOW_INSECURE="true"
 #
-# Set to "1" to disable all third-party IP egress (GDPR Art. 44). With egress
-# off the resolver uses only the offline GeoLite2 MMDB tier, if present.
+# Set to "1" (or "true" / "yes") to disable all third-party IP egress (GDPR
+# Art. 44). With egress off the resolver uses only the offline GeoLite2 MMDB
+# tier, if present, and the monthly MaxMind download is skipped too.
 # IP_GEO_LOOKUP_DISABLED="1"
 
 # -----------------------------------------------------------------------------