Fail loudly on set-but-unparseable env config values (closes #80) (#92)

Defaults now apply only to unset or empty environment variables; a set-but-
unparseable value aborts startup with an error naming the key and the value.
envInt is gone, envBool parses with strconv.ParseBool, and PORT is bounded.

README.md

@@ -89,10 +89,27 @@ TTY detection, and security headers are always applied.
 | `PORT`                  | HTTP listen port                    | `8080`   |
 | `DATA_DIR`              | Directory for all SQLite databases  | `/var/lib/webhooker` |
 | `DEBUG`                 | Enable debug logging                | `false`  |
+| `MAINTENANCE_MODE`      | Serve the maintenance page          | `false`  |
 | `METRICS_USERNAME`      | Basic auth username for `/metrics`  | `""`     |
 | `METRICS_PASSWORD`      | Basic auth password for `/metrics`  | `""`     |
 | `SENTRY_DSN`            | Sentry error reporting DSN          | `""`     |
 
+#### Invalid values abort startup
+
+The defaults above apply **only** to variables that are unset (or set
+to an empty string). A variable that is set but cannot be parsed is a
+fatal configuration error: webhooker logs the offending variable and
+its value and refuses to start, rather than silently running with a
+substituted default. `PORT=eighty`, `DEBUG=ture`, and
+`RETENTION_SWEEP_INTERVAL=1 hour` all abort startup. `PORT` must
+additionally be a number in the range 1–65535.
+
+Boolean variables (`DEBUG`, `MAINTENANCE_MODE`) accept exactly the
+spellings Go's `strconv.ParseBool` accepts — `1`, `t`, `T`, `TRUE`,
+`true`, `True`, `0`, `f`, `F`, `FALSE`, `false`, `False` — and nothing
+else. `yes`, `on`, and `off` are rejected rather than quietly treated
+as false.
+
 On first startup, webhooker automatically generates a cryptographically
 secure session encryption key and stores it in the database. This key
 persists across restarts — no manual key management is needed.