refactor: replace Viper with typed TOML configuration

[Portals]

Replaces Viper with typed configuration loaded once at startup from defaults, the first config.toml, and nonempty environment variables. Preserves documented defaults, exact environment names, and file search order. Passes the maximum mail size directly to the router, removing global configuration from request handling and tests. Removes Viper and its unused transitive dependencies while retaining the existing TOML parser version.

Configuration now accepts TOML with documented field types only. Malformed or unreadable files and invalid port, size, or boolean values stop startup; missing files remain valid for environment-only configuration. These behavior changes are documented. Gmail authentication and the separately planned body-size/header hardening are unchanged.

Validation: uncached go test -race -count=1 ./..., golangci-lint run (zero issues), command build, and git diff --check passed. The production Docker image built successfully; disposable-container smoke tests passed for environment-only mock startup, authentication, mail response, configured size limits, and invalid-port startup failure. Containers were removed afterward.

A fresh-context subagent independently reviewed commit ede82bf116259f50dcb3c7f4c9aa14558f77bc3e against this PR's goal and returned OK.

Stack: 6 of 6, based on #14 (codex/05-standard-router). Review and merge in stack order: #10 → #11 → #12 → #13 → #14 → this PR.