feat(server): tenant-registry skeleton boots against dev stack

Minimal Go service: /healthz + /v1/tenants/by-slug/:slug + /v1/tenants/:id with an in-memory store seeded with the acme tenant. Stdlib-only; pgx + JWT validation land in M4.1 follow-up.

internal/config/config.go

@@ -0,0 +1,33 @@
+package config
+
+import (
+	"fmt"
+	"os"
+)
+
+type Config struct {
+	Env            string // dev | stage | prod
+	Addr           string // listen address, e.g. ":8080"
+	KeycloakIssuer string // e.g. http://localhost:8080/realms/breakpilot-dev
+	DatabaseURL    string // postgres DSN (unused in skeleton; in-memory store)
+}
+
+func Load() (*Config, error) {
+	env := getenv("APP_ENV", "dev")
+	if env != "dev" && env != "stage" && env != "prod" {
+		return nil, fmt.Errorf("invalid APP_ENV %q", env)
+	}
+	return &Config{
+		Env:            env,
+		Addr:           getenv("ADDR", ":8080"),
+		KeycloakIssuer: getenv("KEYCLOAK_ISSUER", "http://localhost:8080/realms/breakpilot-dev"),
+		DatabaseURL:    os.Getenv("DATABASE_URL"),
+	}, nil
+}
+
+func getenv(key, fallback string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return fallback
+}

internal/config/config_test.go

@@ -0,0 +1,52 @@
+package config
+
+import (
+	"testing"
+)
+
+func TestLoad_defaults(t *testing.T) {
+	t.Setenv("APP_ENV", "")
+	t.Setenv("ADDR", "")
+	t.Setenv("KEYCLOAK_ISSUER", "")
+	t.Setenv("DATABASE_URL", "")
+
+	cfg, err := Load()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg.Env != "dev" {
+		t.Errorf("Env = %q, want dev", cfg.Env)
+	}
+	if cfg.Addr != ":8080" {
+		t.Errorf("Addr = %q, want :8080", cfg.Addr)
+	}
+	if cfg.KeycloakIssuer == "" {
+		t.Error("KeycloakIssuer is empty; expected a default")
+	}
+	if cfg.DatabaseURL != "" {
+		t.Errorf("DatabaseURL = %q, want empty default", cfg.DatabaseURL)
+	}
+}
+
+func TestLoad_overrides(t *testing.T) {
+	t.Setenv("APP_ENV", "stage")
+	t.Setenv("ADDR", ":9000")
+	t.Setenv("KEYCLOAK_ISSUER", "https://auth.example/realms/r")
+	t.Setenv("DATABASE_URL", "postgres://x")
+
+	cfg, err := Load()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg.Env != "stage" || cfg.Addr != ":9000" || cfg.KeycloakIssuer != "https://auth.example/realms/r" || cfg.DatabaseURL != "postgres://x" {
+		t.Errorf("overrides not applied: %+v", cfg)
+	}
+}
+
+func TestLoad_invalidEnv(t *testing.T) {
+	t.Setenv("APP_ENV", "bogus")
+	_, err := Load()
+	if err == nil {
+		t.Fatal("expected error for invalid APP_ENV")
+	}
+}