refactor: introduce EnvironmentIndex to make the served environment set runtime-mutable - #17

An omitted field now behaves like an explicitly empty list (which was
already accepted), so a future discovery-only config needs no static
pairs. Statically configured pairs keep working exactly as before.

main() now only loads settings and logging before delegating, so an
alternative binary can compose the proxy from the library crate.

The exhaustive literal broke compilation whenever AppSettings gained a
field; the other test files already spread from default().

The type is the domain concept of which environments the proxy serves,
not a service, so it moves out of services/ to src/environments.rs
beside cache/ — matching how comparable Rust proxies place such state
(e.g. unleash-edge's feature_cache). Drops the services re-export:
EnvironmentService is its only consumer.

Names the content: the key set of one environment (client key, server
keys, provenance). Also unabbreviates EnvSource to EnvironmentSource
and renames records() to snapshot() so no 'record' vocabulary is left.

Nothing reads it: an environment's provenance only matters to the
reconciliation that later phases introduce, and staticness is
derivable there from the immutable environment_key_pairs settings.
Reintroduce an explicit field if that derivation proves awkward.

Evict implies cache-pressure expulsion; this is a deliberate removal
from the served set, and the cache trait already calls its half
remove_environment, so the whole family now shares the verb.

A config that lists the same server key for two environments is a
misconfiguration we choose not to defend against; removal now just
drops the entry's keys unconditionally.

Endpoint-cache lookups run before the key gate, so an in-flight
request that passed the gate could write its result after
remove_environment's clears and have it served indefinitely; the poll
loop, iterating a pre-removal snapshot, could likewise re-insert a
removed environment's document and pin it until restart. Every cache
write now re-checks the index afterwards and clears what it wrote if
the key no longer resolves — remove_environment un-indexes before
clearing, so one of the two clears always runs last. Removal also
clears caches even when the key is unknown, so repeating it cleans any
residue.

The interleavings themselves aren't deterministically testable without
injection points; the tests pin each guard's behaviour instead.

Mirrors HashMap::insert and makes insert symmetric with remove: when a
later phase rotates keys via insert, the caller needs the dropped
server keys to invalidate request caches, which are keyed by presented
key and consulted before the key gate.

The duplicated-server-key failure shape, the /health-stays-red state a
key-less environment creates, and the actual reason run() lives in the
library were all design decisions living only in review threads.

A typo'd environment_key_pairs field name silently parses as an empty
set (serde ignores unknown fields), leaving a healthy-looking proxy
that rejects everything. Also pins the serde default with a test that
{} parses to an empty, valid config.

Nothing besides main.rs ever called it; the composition-binary story it
served is speculative, and it can return the day something real needs
it. The empty-config warning moves with the body.

The endpoint response cache is deprecated and disabled by default;
without it every request passes the key gate, so a cache write racing
a removal is not servable residue worth guarding against. The poll
re-insertion guard on the main environments cache stays — that cache
is load-bearing.