fix(config): treat an empty environment variable as unset

docker-compose.yml forwards its whitelist as "${NAME:-}", so a variable
the operator never set reaches the process as the empty string. Reads
written as a nullish fallback kept that string: the weather client built
an empty base URL and every geocode failed with ERR_INVALID_URL, and the
IP geo lookup requested a relative path.

Reads with a fallback now go through src/lib/env.ts (envValue, envOr,
envFlag), which treats empty and whitespace as unset. IP_GEO_LOOKUP_DISABLED
accepts 1, true, yes and on instead of only "1". A structural test refuses
a ?? fallback written directly against process.env anywhere in src/, and
the compose whitelist guard counts the helper's call shape as a read.

src/app/api/internal/deploy-webhook/route.ts

@@ -1,3 +1,4 @@
+import { envOr } from "@/lib/env";
 import { timingSafeEqual } from "node:crypto";
 import { NextRequest, NextResponse } from "next/server";
 import { apiHandler } from "@/lib/api-handler";
@@ -190,7 +191,7 @@ async function notifyAdminsOfFailure(event: NormalizedEvent): Promise<void> {
         // Optional: operators can point this at their deployment
         // dashboard (e.g. the Coolify UI). Falls back to an empty
         // string so the body template still composes cleanly.
-        logsUrl: process.env.DEPLOY_LOGS_URL ?? "",
+        logsUrl: envOr("DEPLOY_LOGS_URL", ""),
       },
       metadata: {
         source: "deploy-webhook",