Fail loudly on set-but-unparseable env config values (closes #80) (#92)

Defaults now apply only to unset or empty environment variables; a set-but-
unparseable value aborts startup with an error naming the key and the value.
envInt is gone, envBool parses with strconv.ParseBool, and PORT is bounded.

TODO.md

@@ -13,19 +13,16 @@
 pre-1.0. No git tags exist. main (4f5ecb1) is a working webhook proxy
 with auth, CSRF/SSRF protections, login rate limiting, Slack target,
 event retention (#63), the database archiving target (#43), the admin
-password change flow (#65), policy compliance (#6), and pinned lint
-tooling (#55). Note: TODO.md was deliberately deleted from this repo in
-f9a9569 (2026-03-01, #6); its content was folded into the README TODO
-section, which this draft reconstructs as of 2026-07-06.
+password change flow (#65), policy compliance (#6), pinned lint tooling
+(#55), and fail-loud configuration parsing (#80). Note: TODO.md was
+deliberately deleted from this repo in f9a9569 (2026-03-01, #6); its
+content was folded into the README TODO section, which this draft
+reconstructs as of 2026-07-06.
 
 # Next Step
 
-Implement automatic event retention cleanup based on retention_days: a
-periodic maintenance job that deletes Events, Deliveries, and
-DeliveryResults older than the parent webhook's retention_days from each
-per-webhook event database. The field exists on the Webhook model and
-the README promises the behavior, but nothing enforces it, so event
-databases currently grow without bound.
+Manual event redelivery from the web UI (replay is a core promised
+capability in the README rationale).
 
 # Completed Steps
 
@@ -44,6 +41,13 @@ databases currently grow without bound.
   its handle while deliberately leaving `archive-{webhookID}.db` on
   disk, and a new `ArchiveSweeper` prunes idle archives on the existing
   `RETENTION_SWEEP_INTERVAL` without ever creating an archive file
+- 2026-08-09 Configuration parsing fails loudly on set-but-unparseable
+  environment values: `envInt` removed in favour of `envPositiveInt`
+  plus a `PORT` range check, `envBool` now parses with
+  `strconv.ParseBool`, and defaults apply only to unset variables (#80)
+- 2026-08-07 Automatic event retention cleanup based on
+  `retention_days`, deleting expired events, deliveries, and delivery
+  results from each per-webhook event database (#63)
 - 2026-08-07 Update golangci-lint to v2.12.2 (Docker image digest in
   `Dockerfile`, release-archive sha256 pins in `script/bootstrap`),
   adopt the canonical `.golangci.yml` (v2 `linters.settings` layout so
@@ -72,8 +76,6 @@ databases currently grow without bound.
 
 # Future Steps
 
-- Manual event redelivery from the web UI (replay is a core promised
-  capability in the README rationale)
 - Delivery status and retry management UI
 - Per-webhook rate limiting in the receiver handler (per-webhook config
   plus handler enforcement; global limits must not apply to receiver