feat(server): tenant-registry skeleton boots against dev stack

Minimal Go service: /healthz + /v1/tenants/by-slug/:slug + /v1/tenants/:id with an in-memory store seeded with the acme tenant. Stdlib-only; pgx + JWT validation land in M4.1 follow-up.

internal/config/config.go

@@ -0,0 +1,33 @@
+package config
+
+import (
+	"fmt"
+	"os"
+)
+
+type Config struct {
+	Env            string // dev | stage | prod
+	Addr           string // listen address, e.g. ":8080"
+	KeycloakIssuer string // e.g. http://localhost:8080/realms/breakpilot-dev
+	DatabaseURL    string // postgres DSN (unused in skeleton; in-memory store)
+}
+
+func Load() (*Config, error) {
+	env := getenv("APP_ENV", "dev")
+	if env != "dev" && env != "stage" && env != "prod" {
+		return nil, fmt.Errorf("invalid APP_ENV %q", env)
+	}
+	return &Config{
+		Env:            env,
+		Addr:           getenv("ADDR", ":8080"),
+		KeycloakIssuer: getenv("KEYCLOAK_ISSUER", "http://localhost:8080/realms/breakpilot-dev"),
+		DatabaseURL:    os.Getenv("DATABASE_URL"),
+	}, nil
+}
+
+func getenv(key, fallback string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return fallback
+}