fix: address code review findings from story #01

- Makefile: -include .env (soft) so fresh clone doesn't hard-fail
- main.go: replace log.Fatalf-in-goroutine with error channel; startup
  failures now reach main goroutine so defer pool.Close() always runs
- main.go: context.WithTimeout(30s) on database.Connect to fail fast
  instead of hanging indefinitely on unreachable Postgres
- router.go: store pool on Echo context via middleware so future story
  handlers can retrieve it with c.Get("pool")
- config.go: require DATABASE_URL explicitly (log.Fatal if missing)
  instead of falling back to hardcoded credentials
- HelloWorld.test.ts: URL-aware fetch stub + afterEach restoreAllMocks;
  add flushPromises test verifying backend status renders

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/internal/config/config.go

@@ -1,6 +1,7 @@
 package config
 
 import (
+	"log"
 	"os"
 )
 
@@ -11,11 +12,13 @@ type Config struct {
 }
 
 // Load reads configuration from environment variables.
-// DATABASE_URL is required; PORT defaults to "3000".
+// DATABASE_URL is required (no silent default — fails fast if missing).
+// PORT defaults to "3000".
 func Load() *Config {
 	dbURL := os.Getenv("DATABASE_URL")
 	if dbURL == "" {
-		dbURL = "postgres://osdb:osdb@localhost:5432/osdb?sslmode=disable"
+		log.Fatal("DATABASE_URL environment variable is required but not set. " +
+			"Copy .env.example to .env and set the correct value.")
 	}
 
 	port := os.Getenv("PORT")