chore: remove the empty runtime-config file and its plumbing

public/config.js assigned an empty object to window.env and nothing ever
read it. Nothing in src, e2e, supabase, scripts, or any of the 58 static
pages references window.env or globalThis.env; the app reads Vite's
import.meta.env instead.

It was loaded as a blocking script in <head> on every page, so removing it
also drops one request from the critical path.

Removes the file and everything that existed only to serve it: the script
tag in index.html, the service-worker app-shell entry, the Vercel and nginx
no-cache rules, and the /config.js row in the deployment-config test.

Also drops a latent trap in nginx.conf. The JS/CSS caching block carried

    if ($request_uri ~* "config\.js") { return 404; }

which matches on substring, so any hashed bundle whose URI contained
"config.js" would have 404'd. With the file gone the guard has nothing to
protect and is deleted rather than narrowed.

The service worker degrades safely either way: install uses
Promise.allSettled and only caches responses that are ok, so a missing
app-shell entry could never fail installation.

Verified: lint, typecheck, 924 unit tests, 121 edge tests, build, and 126
Chromium e2e tests pass. `nginx -t` passes against the real nginx:alpine
image with this config mounted, and the built dist/index.html contains no
config.js reference.

Author: Programcode

index.html

@@ -66,7 +66,6 @@
         ]
       }
     </script>
-    <script src="/config.js"></script>
     <script src="/theme-init.js"></script>
   </head>
 

nginx.conf

@@ -18,12 +18,7 @@ server {
     if ($uri ~ ^/(app(?:/|$)|login$|share/)) { set $robots_tag "noindex, nofollow"; }
     add_header X-Robots-Tag $robots_tag always;
 
-    # Do not cache runtime bootstraps so config and theme behavior update instantly.
-    location = /config.js {
-        expires -1;
-        add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
-    }
-
+    # Do not cache the theme bootstrap so theme behavior updates instantly.
     location = /theme-init.js {
         expires -1;
         add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
@@ -84,10 +79,6 @@ server {
 
     # Cache JS/CSS bundles (Vite adds hashes to these, so caching is safe)
     location ~* \.(?:css|js)$ {
-        # But exclude config.js which we handled above
-        if ($request_uri ~* "config\.js") {
-            return 404; # Should not happen due to the = /config.js block above
-        }
         expires 1y;
         add_header Cache-Control "public";
     }

public/config.js

@@ -18,7 +18,6 @@ const APP_SHELL = [
   '/app/history',
   '/app/settings',
   '/index.html',
-  '/config.js',
   '/theme-init.js',
   '/manifest.webmanifest',
   '/favicon.ico',

public/sw.js

@@ -127,7 +127,7 @@ describe("Vercel frontend deployment configuration", () => {
     },
   );
 
-  it.each(["/index.html", "/config.js", "/theme-init.js", "/sw.js"])(
+  it.each(["/index.html", "/theme-init.js", "/sw.js"])(
     "prevents stale caching for %s",
     (source) => {
       const config = loadConfig();

src/test/vercel-deployment-config.test.ts

@@ -84,15 +84,6 @@
         }
       ]
     },
-    {
-      "source": "/config.js",
-      "headers": [
-        {
-          "key": "Cache-Control",
-          "value": "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0"
-        }
-      ]
-    },
     {
       "source": "/theme-init.js",
       "headers": [