* feat(feature-flags): AppConfig-backed gated feature flags
* fix(ci): repoint 'Validate feature flags' step to env-flags.ts after rename
* improvement(feature-flags): drop in-code defaults; fallback resolves a per-flag secret, gating is AppConfig-only
* improvement(feature-flags): make flag names a closed set so every flag requires a fallback secret
* improvement(feature-flags): single FEATURE_FLAGS registry — each entry defines name, description, and fallback in one place
* improvement(feature-flags): fallback is the env secret key (keyof typeof env), resolved to a boolean