Abort startup on an unknown PIXA_ environment variable (closes #133)

A variable whose name starts with PIXA_ but is neither a setting's
variable, from the list pairing each config key with its variable, nor
PIXA_CONFIG_PATH now aborts startup naming it, as an unknown config key
does. PIXA_PORT is named with a pointer to PORT. The check runs after
the config file loads, so the variables the file's env section sets are
checked too. README.md says so under Configuration.

Model: opus-5-5

script/docker-smoke

@@ -16,10 +16,8 @@ main() {
     # removed on exit.
     key="$(head -c 32 /dev/urandom | base64)"
 
-    # Docker 25 and later probe every 5 seconds during the image's
-    # 10-second start period. --health-interval=1s makes it probe every
-    # second after that instead of every 30, so a slow start still shows
-    # as healthy within the 30-second wait.
+    # --health-interval=1s overrides the image's 30s interval so the
+    # first probe does not use up the whole wait.
     cid="$(docker create --health-interval=1s \
         -e PIXA_SIGNING_KEY="$key" "$("$SCRIPT_DIR/projectname")")"
     # Remove the container on any exit; turning signals into exit makes