fix: allow zero-config Vercel deployment

[Che-Zhu]

Summary

• allow the public Fulling app to build and run on Vercel without Auth or database environment variables
• degrade unavailable authentication to an explicit login state and structured 503 API response
• pin Vercel to Node.js 22 and document the zero-configuration deployment path
• remove stale pnpm npm configuration and the Docker environment-validation bypass

Why

The current GitHub Auth path is broken and will be replaced. Requiring Better Auth, GitHub OAuth, and PostgreSQL values prevented the public application from deploying even though those capabilities are not needed for the current preview.

This PR addresses the zero-configuration deployment slice of #181. It does not claim completion of the issue's future authentication, persistence, or Kubernetes connectivity acceptance criteria.

Behavior

• / returns the public landing page
• /login renders a sign-in unavailable state
• /api/auth/* returns 503 AUTH_UNAVAILABLE without a complete legacy Auth configuration
• protected routes redirect to /login
• the legacy Auth path remains available only when all existing Auth and database variables are present

Validation

• Node.js 22 production image built with no environment variables and without SKIP_ENV_VALIDATION
• runtime smoke test: / 200, /login 200, /workspace 307 to /login, /api/auth/session 503
• npm run lint
• npm test (38 tests)