Harden per-environment config + chain isolation guardrails

[trietlu]

Description

Extend env.ts/contract.ts so a misconfigured environment fails fast: refuse to boot when BLOCKCHAIN_ENABLED but RPC/key/contract missing; assert CHAIN_ENV/VERCEL_ENV consistency; guarantee staging can never carry a mainnet chainId/contract and vice versa. Run assertConfiguredChain() before the first anchor. Add unit tests for the matrix.

Affected areas

backend/src/config/env.ts, backend/src/config/contract.ts, backend/src/**/*.test.ts.

Dependencies / order

No blockers; can run in parallel with #3.

Acceptance criteria

• Staging config carrying chainId 8453 (or a mainnet contract) refuses to start; production carrying 84532 refuses to start.
• assertConfiguredChain() runs before anchoring; an RPC whose real chainId differs from env.chainId is rejected.
• Unit tests cover the staging/prod x chainId matrix and the missing-config cases.
• The per-environment env-var set is documented (extends Architecture.md section 10).

Definition of done

• Implemented on a short-lived feature branch, merged into staging (never main).
• Verified on the staging preview stack.
• Docs updated if infra/env/API behavior changes.