refactor(website): load secrets from Astro server environment

[theosanderson]

Summary

This is a stacked follow-up to #6994. It moves both secrets consumed by the website out of the processed runtime_config.json file and into Astro's typed server environment API.

The transaction-cookie encryption key and existing Keycloak client secret are now declared as server-only secret fields in astro.config.mjs. Kubernetes injects both values directly from their existing Secrets into the website container, and the website imports them from astro:env/server at runtime.

The config processor remains in place because website organism configuration still uses it to materialize remote reference URLs, but it no longer receives or substitutes either website secret. Non-secret deployment configuration continues to use runtime_config.json.

Impact

• Website secrets are no longer written into the processed JSON configuration volume.
• Secret values remain runtime-only and are not embedded in the built server or browser bundles.
• All website replicas continue to receive the same Kubernetes-managed transaction-cookie key.
• Local development documents the two required environment variables in .env.example.
• Vitest uses a dedicated alias containing non-secret test values for Astro's virtual server-environment module.

Verification

• CI=1 npm run test -- --run — 71 files and 722 tests passed.
• npm run check-types — Astro and TypeScript reported no errors, warnings, or hints.
• npm run format — passed.
• npm run build — production server build completed successfully.
• Confirmed the production build does not contain the test secret values.
• helm lint kubernetes/loculus -f kubernetes/loculus/values.yaml — passed.
• Rendered the Helm chart and confirmed both secret references appear on the website container and no longer appear in runtime_config.json.

Depends on #6994.

🚀 Preview: Add preview label to enable