fix(config): treat every blank template key as unset

[CARLOSNAMIAS]

What changes

Eleven optional environment keys that .env.example publishes blank move from
z.string().optional() to the OptionalNonEmpty helper already defined in
config.ts. Ten of them currently reach the config object as "" instead of unset:

githubOauthClientId, githubOauthClientSecret, oidcClientId, oidcClientSecret,
facilityInstanceId, githubAppId, githubAppPrivateKey, githubAppWebhookSecret,
githubAppSlug, githubCloneToken

Three test cases are added that pair the published template with the schema that has
to accept it.

Why

pnpm dev copies .env.example verbatim apart from the two secrets it generates, so
every blank key reaches readConfig exactly as shipped. Nothing breaks today — every
consumer happens to test truthiness (github/client.ts:56, story-domain.ts:56,
worker.ts:21) — but this is the same defect class that made the API refuse to boot
from a copied .env.example in #158 and #183, and it fails the moment a consumer
reaches for ?? or !== undefined. The OptionalNonEmpty helper exists for exactly
this, with a comment saying so; it just was not applied to these keys.

Nothing covered the template/schema pair before: config.test.ts builds its own
environment objects and scripts/dev.test.mjs writes its own template, so the two
files could drift again without a failing test. The invariant the third case fixes —
no config field is an empty string on a first run — holds for keys added to the
template later, not just today's.

Related: #158, #183.

Verification

• pnpm verify passes locally
• Behaviour verified beyond the test suite (say how)
• Documentation updated, or no user-facing change

I could not run pnpm verify: I am on Windows 11 (Node 24.12.0, pnpm 11.20.0) without
the local PostgreSQL and Docker stack, and the Docker and Vercel tiers need a Unix shell
on the host. Rather than claim a green suite I did not produce, here is exactly what I
ran and what it proved:

Command	Result
pnpm --filter @facility/api exec vitest run test/config.test.ts	20 passed
same, with services/api/src/config.ts reverted	1 failed — the new invariant case, naming all ten fields
pnpm --filter @facility/api exec vitest run	14 failed, 232 passed, 16 skipped
same, on an unmodified tree	14 failed, 229 passed, 16 skipped
pnpm --filter @facility/api typecheck	clean

The 14 failures are the Docker and Vercel tiers (spawn sh ENOENT,
sudo: unexpected argument '-u'), identical with and without this change. I did not run
pnpm test:e2e-workspace or the database integration suites, and I did not exercise the
running application in a browser — this change has no UI surface.

pnpm exec biome check services/api reports 100 errors on my machine and the same 100 on
an unmodified tree: a CRLF working tree on Windows, not this change. The committed content
is LF.