feat(config,tutor): reconcile secrets validation and complete AI tutor auth

[ToldYO]

Summary of Changes

This PR reconciles application secrets management following PR #208 and completes the authenticated AI Tutor and Stockfish Coach features.

1. Secrets & Environment Validation

• validateEnvironment.js:
  • Added startup diagnostics to fail fast if INDEX_KEY is empty/unset across all environments, preventing silent runtime 500 errors on user login.
  • Added startup logging for GEMINI_API_KEY / OPENAI_API_KEY to notify developers if AI features will run in rule-based offline fallback mode.
• Documented full 40+ key configuration inventory across node-config, direct process.env, and REACT_APP_*.

2. Client-Side Agora Consistency

• environment.js:
  • Updated development config to read process.env.REACT_APP_AGORA_APP_ID || '6b7772f2a76f406192d8167460181be0', matching production build-time behavior while preserving local zero-config defaults.

3. AI Tutor Session & Ownership Hardening

• ChatWidget.tsx:
  • Removed static fallback user ID (5f8f8c44b54764421b7156e0) and eliminated the redundant /user/getUser network pre-fetch.
  • Session initiation now sends Authorization: Bearer ${cookies.login} and omits userId, allowing POST /chat/session to securely bind directly to req.user.

4. Stockfish Move Feedback Authentication

• StockfishTutor.tsx:
  • Added token?: string parameter to getAiFeedbackForMove and attached Authorization: Bearer ${token} header to POST /chat/chess-feedback.
  • Added useCookies(['login']) to StockfishTutor component and passed cookies.login across all 4 move analysis pathways.

---

Test & Verification Results

• Backend (middlewareNode): 264/264 passing across 22 test suites (routeSecurity.test.js, cors.test.js, requireAuth.test.js, leaderboard.test.js, streak.test.js, etc.).
• Frontend (react-ystemandchess): 156/156 passing across 29 test suites (PlayComputer.test.tsx, Login.test.tsx, etc.).