feat: add production deployment and runtime safeguards

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/env.mjs

@@ -20,6 +20,7 @@ export const paths = {
 };
 
 export let APP_PORT = envNumber('APP_PORT', 3910);
+export let APP_HOST = envString('APP_HOST', '127.0.0.1');
 
 function refreshEnvDerivedValues() {
   paths.db = process.env.APP_DB_PATH || path.join(projectRoot, 'data', 'maquina-pessoal.db');
@@ -27,6 +28,7 @@ function refreshEnvDerivedValues() {
   paths.cnpjDir = process.env.CNPJ_BASE_DIR || path.join(projectRoot, 'prospeccao', 'cnpj');
   paths.rfbRaw = path.join(paths.cnpjDir, 'rfb-raw');
   APP_PORT = envNumber('APP_PORT', 3910);
+  APP_HOST = envString('APP_HOST', '127.0.0.1');
 }
 
 export async function loadDotEnv(rootDir = projectRoot) {
@@ -59,3 +61,11 @@ export function envNumber(name, fallback) {
 export function envString(name, fallback) {
   return process.env[name] || fallback;
 }
+
+export function telegramConfig() {
+  return {
+    enabled: process.env.TELEGRAM_ALERTS_ENABLED === 'true',
+    botToken: process.env.TELEGRAM_BOT_TOKEN || '',
+    chatId: process.env.TELEGRAM_CHAT_ID || ''
+  };
+}