feat(config, tutor): reconcile environment separation, port map invariants, and AI tutor auth

[ToldYO]

Summary

Implements the forensic remediation plan for environment separation and port alignment:

1. Replaces the hardcoded 8080 fallback port in development with the authoritative port map (chessServerURL: 3001, chessClientURL: 3002, middlewareURL: 8000, stockfishServerURL: 8080).
2. Fixes environment.prod.js to enforce explicit build-time URL variables via requiredProductionEnv.
3. Completes AI Tutor authentication reconciliation by passing JWT bearer tokens to /chat/session and /chat/chess-feedback.
4. Adds build arguments to the root docker-compose.yml and updates the Dockerfile.
5. Adds automated port invariant unit tests, middlewareNode CI testing, and a PR single-authorship check.

Type of Change

• New feature
• Bug fix
• Refactor
• Documentation update
• Style/UI update
• Performance improvement
• Other: CI/CD & Docker configuration

Key Changes

• Frontend Environment: Fixed fallback URLs in src/environments/environment.js, updated environment.prod.js, and added REACT_APP_CHESS_CLIENT_URL to Dockerfile.
• AI Tutor Auth: Updated ChatWidget.tsx and StockfishTutor.tsx to forward cookies.login JWT token in Authorization headers.
• Middleware Validation: Updated validateEnvironment.js with clear startup diagnostics for development and bypass for tests.
• Docker Compose: Wired build args in canonical root docker-compose.yml and deleted dead deploy/dev/docker-compose.yml.
• CI & Tests: Added Test middlewareNode step and PR single-authorship validation in .github/workflows/ci.yml. Added environment.test.js asserting port invariants and no temporary hack markers.

Testing

• Unit tests added/updated (react-ystemandchess/src/environments/environment.test.js)
• Integration tests added/updated
• Manual testing performed
• All tests pass:
  • react-ystemandchess: 30/30 suites passed (163 tests)
  • middlewareNode: 22/22 suites passed (264 tests)
  • chessServer: 4/4 suites passed (33 tests)
  • stockfishServer: 2/2 suites passed (12 tests)

Bugs Fixed (if applicable)

• Fixed chessServerURL pointing to 8080 in dev config.
• Fixed missing chessClientURL (port 3002) in frontend configs.
• Fixed dead path secrets injection in CI.
• Prevented silent Nginx upstream reverts.

Additional Notes

• Replaces PR feat(config,tutor): reconcile secrets validation and complete AI tutor auth #213 with a clean, reviewable diff (~8 files of true delta) on top of the environment separation baseline.