[codex] chore: consolidate env config

[Zetazzz]

Summary

Consolidates server-related environment configuration into the existing PGPM/Constructive options pipeline.

Changes

• Adds captcha.recaptchaSecretKey and upload.maxFileSize to PGPM and Constructive option types.
• Parses RECAPTCHA_SECRET_KEY and MAX_UPLOAD_FILE_SIZE in @pgpmjs/env.
• Passes CAPTCHA and GraphQL upload configuration into graphql-server from effectiveOpts instead of reading env directly in middleware/runtime setup.
• Adds CAPTCHA middleware coverage proving the secret comes from explicit config rather than direct process.env access.
• Updates env merge tests, snapshots, and env README documentation.

Validation

• pnpm --filter @pgpmjs/types build
• pnpm --filter @pgpmjs/env test
• pnpm --filter @pgpmjs/env build
• pnpm --filter @constructive-io/graphql-types build
• pnpm --filter @constructive-io/graphql-env test
• pnpm --filter @constructive-io/graphql-env build
• pnpm --filter @constructive-io/express-context build
• pnpm --filter @constructive-io/graphql-server test -- captcha.test.ts
• pnpm --filter @constructive-io/graphql-server build
• git diff --cached --check

[Zetazzz]

Closing in favor of same-repository PR #1342 from constructive-io/constructive:chore/env-config-consolidation-main.