Fix F1ServerApp config/bootstrap review findings

[LarsLaskowski]

Pull Request

📖 Description

Fixes a batch of low-severity findings from the repository review affecting
F1ServerApp configuration and bootstrap:

• environment.ts/environment.prod.ts no longer need @ts-ignore: a new
  src/typings.d.ts declares window.env so the runtime-injected config is
  properly typed.
• main.ts documents why the dev-mode getBaseUrl uses 4812 (the backend's
  dev port from F1Server.WebApi/Properties/launchSettings.json) instead of
  the frontend's own 4810 dev server port.
• F1ServerApp.esproj's BuildOutputFolder now matches the actual
  dist/f1-server-app output used by angular.json and the Dockerfile.
• apk add curl uses --no-cache.
• The non-deterministic npm install -g npm@latest step is removed; the
  build now uses the npm version shipped with the pinned node:26-alpine
  base image.
• karma.conf.js no longer references @angular-devkit/build-angular
  (not a dependency, and not needed by the actual @angular/build:karma
  test builder). While verifying the test target actually runs, the
  polyfills option in angular.json also needed to be an array rather
  than a string for that builder's schema; both are fixed together.
• src/assets/env.js and env.template.js now document their relationship:
  env.js is the local dev default (used by ng serve/ng build and
  index.html), while env.template.js is the source template rendered
  into env.js by docker_entrypoint.sh at container startup.

🎫 Issues

• Closes F-390 · Environment-specific runtime config with default apiUrl = "http://localhost/" is versioned, even though … #304
• Closes F-329 · Frameworks contain @angular-devkit/build-angular, but the test builder in angular.json is … #243
• Closes F-328 · AppServerModule imports AppModule for SSR, but there is no server entry/server.ts and no SSR configuration in … #242
• Closes F-327 · npm install -g npm@latest makes the build non-deterministic (the npm version changes over time). Better to … #241
• Closes F-326 · node:25-alpine is an odd (non-LTS) Node major. BASE_NGINX_DIGEST is only used for OCI labels, the FROM itself … #240
• Closes F-324 · BuildOutputFolder = dist\f1serverapp, while angular.json builds to dist/f1-server-app and the Dockerfile … #238
• Closes F-316 · The dev getBaseUrl returns a hardcoded http://localhost:4812/, while npm start/README name port 4810 … #232
• Closes F-317 · //@ts-ignore + untyped window["env"]["apiUrl"]. Runtime env injection is project-typical; a typed env … #233

#242 (orphaned AppServerModule) was already resolved by a prior change
that removed app.server.module.ts; no further code change was needed here.

👩‍💻 Reviewer Notes

All changes are configuration/documentation-level; no runtime behavior
changes except the nginx base image now being resolved by digest and
apk add curl no longer caching the package index.

📑 Test Plan

npm run build succeeds and confirms the typings.d.ts change removes the
need for @ts-ignore without introducing type errors. The Angular test
target (ng test) now builds and launches Karma/Chrome successfully after
the polyfills fix; no spec files exist yet, matching the current CI setup.

✅ Checklist

General

• I have tested my changes.
• I have read the CONTRIBUTING documentation and followed the project's code style guidelines.

⏭ Next Steps

None.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud