refactor: centralise config constants, cache headers, and env vars

[james-cross]

Summary

Centralise magic values, hardcoded strings, and environment variable access into dedicated config modules. This is implementation plan chunk 02 (Config Centralisation).

Changes

• Add src/config/constants.ts with DB_NAME, API default limits, timeouts, cache TTLs, cache header strings, and no-cache response header objects
• Add src/config/env.ts with centralised environment variable access, validation helpers, and environment detection (isTest, isDev, isProd)
• Replace 18 hardcoded client.db('streetsupport') calls with client.db(DB_NAME) across API routes, helpers, repositories, and utilities
• Replace hardcoded cache header strings with CACHE_HEADERS.* constants across 12 API routes
• Replace inline no-cache header objects with NO_CACHE_RESPONSE_HEADERS in 4 dynamic endpoints (banners, SWEP, logos, resources)
• Replace inline process.env.NODE_ENV === 'test' || process.env.PLAYWRIGHT_TEST === '1' checks with env.isTest()
• Replace hardcoded timeout values (15000ms, 10000ms) and limits (500, 50, 20, 10) with named constants in FindHelpPageClient and API routes
• Move module-level baseUrl in sitemap route into the handler to fix a test isolation issue exposed by the new imports

Testing

• 466 unit tests passing
• TypeScript type check clean
• ESLint clean
• Next.js build succeeds
• Grep verification confirms zero hardcoded DB name strings and zero hardcoded cache header strings remaining outside config