🔧 refactor: implement 12-factor runtime config for all web apps

Replace window injection and build-time env vars with runtime config
loaded from /config.json (generated by Docker entrypoint). This fixes
the staging deployment issue where apps were requesting localhost URLs
instead of production URLs.

Changes:
- Add runtime.ts config loader with Zod validation (fail-hard in prod)
- Disable SSR via +layout.ts (apps are client-only SPAs)
- Update API clients and auth stores to use async config getters
- Add docker-entrypoint.sh scripts to generate config.json at startup
- Update Dockerfiles with ENTRYPOINT for config generation
- Simplify docker-compose.staging.yml env vars (12-factor pattern)
- Add static/config.json as dev fallback (localhost defaults)
- Fix onMount return type (Svelte 5 compatibility)
- Add zod dependency to Picture app
- Add backward compat exports for Contacts app

Apps updated:
- Clock (port 3017)
- Chat (port 3002)
- Picture (port 3006)
- Contacts (port 3015)
- Calendar (port 3016)
- Manacore (multi-app platform)

Benefits:
- Build once, deploy anywhere (same Docker image for all envs)
- Configuration in environment, not code (12-factor compliance)
- Fail-hard on missing/invalid config in production
- No accidental SSR localhost fallbacks
- Schema validation ensures all required URLs are present

docker-compose.staging.yml

@@ -137,12 +137,10 @@ services:
     environment:
       NODE_ENV: staging
       PORT: 3000
-      # Server-side URLs (Docker internal network)
-      PUBLIC_BACKEND_URL: http://chat-backend:3002
-      PUBLIC_MANA_CORE_AUTH_URL: http://mana-core-auth:3001
-      # Client-side URLs (browser access via HTTPS staging domains)
-      PUBLIC_BACKEND_URL_CLIENT: https://chat-api.staging.manacore.ai
-      PUBLIC_MANA_CORE_AUTH_URL_CLIENT: https://auth.staging.manacore.ai
+      # Runtime config generation (12-factor pattern)
+      # These vars are used by docker-entrypoint.sh to generate /config.json
+      BACKEND_URL: https://chat-api.staging.manacore.ai
+      AUTH_URL: https://auth.staging.manacore.ai
     ports:
       - "3000:3000"
     healthcheck:
@@ -173,16 +171,14 @@ services:
     environment:
       NODE_ENV: staging
       PORT: 5173
-      # Auth URLs
-      PUBLIC_MANA_CORE_AUTH_URL: http://mana-core-auth:3001
-      PUBLIC_MANA_CORE_AUTH_URL_CLIENT: https://auth.staging.manacore.ai
-      # Backend URLs for dashboard widgets
-      PUBLIC_TODO_API_URL: http://todo-backend:3018
-      PUBLIC_TODO_API_URL_CLIENT: https://todo-api.staging.manacore.ai
-      PUBLIC_CALENDAR_API_URL: http://calendar-backend:3016
-      PUBLIC_CALENDAR_API_URL_CLIENT: https://calendar-api.staging.manacore.ai
-      PUBLIC_CLOCK_API_URL: http://clock-backend:3017
-      PUBLIC_CLOCK_API_URL_CLIENT: https://clock-api.staging.manacore.ai
+      # Runtime config generation (12-factor pattern)
+      # These vars are used by docker-entrypoint.sh to generate /config.json
+      API_BASE_URL: https://staging.manacore.ai
+      AUTH_URL: https://auth.staging.manacore.ai
+      TODO_API_URL: https://todo-api.staging.manacore.ai
+      CALENDAR_API_URL: https://calendar-api.staging.manacore.ai
+      CLOCK_API_URL: https://clock-api.staging.manacore.ai
+      CONTACTS_API_URL: https://contacts-api.staging.manacore.ai
     ports:
       - "5173:5173"
     healthcheck:
@@ -315,10 +311,10 @@ services:
     environment:
       NODE_ENV: staging
       PORT: 5186
-      PUBLIC_BACKEND_URL: http://calendar-backend:3016
-      PUBLIC_MANA_CORE_AUTH_URL: http://mana-core-auth:3001
-      PUBLIC_BACKEND_URL_CLIENT: https://calendar-api.staging.manacore.ai
-      PUBLIC_MANA_CORE_AUTH_URL_CLIENT: https://auth.staging.manacore.ai
+      # Runtime config generation (12-factor pattern)
+      # These vars are used by docker-entrypoint.sh to generate /config.json
+      BACKEND_URL: https://calendar-api.staging.manacore.ai
+      AUTH_URL: https://auth.staging.manacore.ai
     ports:
       - "5186:5186"
     healthcheck:
@@ -383,10 +379,10 @@ services:
     environment:
       NODE_ENV: staging
       PORT: 5187
-      PUBLIC_BACKEND_URL: http://clock-backend:3017
-      PUBLIC_MANA_CORE_AUTH_URL: http://mana-core-auth:3001
-      PUBLIC_BACKEND_URL_CLIENT: https://clock-api.staging.manacore.ai
-      PUBLIC_MANA_CORE_AUTH_URL_CLIENT: https://auth.staging.manacore.ai
+      # Runtime config generation (12-factor pattern)
+      # These vars are used by docker-entrypoint.sh to generate /config.json
+      API_BASE_URL: https://clock-api.staging.manacore.ai
+      AUTH_URL: https://auth.staging.manacore.ai
     ports:
       - "5187:5187"
     healthcheck: