fix(core): switch dev CLI to cnsupa publishable key

[orga-agent]

Summary

• replace the built-in FlickNote dev HS256-shaped anon key with the deployed opaque cnsupa publishable key
• preserve stable dev endpoints, production defaults, and explicit config/environment overrides
• document the one-time flicknote login --force boundary for existing dev installations without deleting the local PowerSync database
• add coverage for the full empty-config Config::load() dev fallback path

Verification

• cargo build
• cargo test -p flicknote-core config::tests
• cargo test --workspace --all-targets --all-features
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo fmt --all --check
• git diff --check

Scope

Production configuration, version bumps, tags, release publication, deployment, and live-user account acceptance are intentionally excluded.