fix(security): validate required env vars (SMB_ADDRESS, CORS_ORIGIN) at startup

[birme]

Summary

The server previously started even when critical environment variables were unset, silently falling back to defaults. This adds fail-fast startup validation for SMB_ADDRESS and CORS_ORIGIN: if either is missing, the process logs which variable is missing and exits with code 1 before the server begins listening.

The check is placed at the top of the startServer() startup path in src/server.ts (before dbManager.connect() and server.listen()), so it only triggers on actual boot and does not affect module-import behavior. DB_CONNECTION_STRING is intentionally excluded (tracked separately in #225).

Test plan

• npm run typecheck passes
• npm test shows no regressions from this change (identical pass/fail counts vs. clean main; the 94 pre-existing failures are an unrelated @fastify/cookie dynamic-import issue from a recent dependency bump)
• Manual review: with SMB_ADDRESS or CORS_ORIGIN unset, startup exits 1 with a clear message; with both set, boot proceeds normally

Closes #232

[birme]

Code Review — Verdict: Needs Changes

Self-authored PR; verdict recorded as a marker (GitHub blocks state-bearing self-review by the author's own account).

Blocking

• src/server.ts:61-69 — the startup-validation behavior change ships with zero tests. Add coverage that missing/empty SMB_ADDRESS => exit(1), missing/empty CORS_ORIGIN => exit(1), and both-set => startup proceeds.

Warnings

• src/server.ts:10-14 vs 61-68 — contradiction: module-level code still sets an SMB_ADDRESS default and logs "using defaults", but startServer() now exit(1)s when it's unset, so that default is dead/misleading. Remove it or reconsider requiring SMB_ADDRESS.
• src/server.ts:66 — uses raw console.error instead of the project Log() convention used everywhere else in the file.

Note: requiring CORS_ORIGIN is a safe hardening (src/api.ts already sets origin:false when unset) but deploys that relied on that silent default will now refuse to boot — call this out in release notes.

Moving issue #232 back to Ready for a follow-up commit on this same branch.

[birme]

Code Review — Verdict: LGTM (self-authored PR; recorded as marker since GitHub blocks state-bearing self-review by the author's own account)

The follow-up commit adds src/server.test.ts (5 tests) covering missing/empty SMB_ADDRESS and CORS_ORIGIN => exit(1) and the both-set happy path, via a throwing process.exit mock and mocked ./api/./db/*. The require.main === module guard is correct (server still starts under ts-node in prod, stays inert under Jest import). Dead SMB_ADDRESS default removed, plaintext-URL warning guarded, validation error switched to Log().error. New test suite is self-contained and independent of the ~94 pre-existing environmental Jest failures.

Non-blocking: making CORS_ORIGIN hard-required is by design per #232 but is a deploy-affecting change — update readme.md:70 and confirm OSC/Docker deploys set CORS_ORIGIN (call out in release notes). DB-protocol validation still throws at import before env validation (tracked separately in #225).

Awaiting a human with a different account to approve + merge (required review; automation account cannot self-approve).