test(server): src/config takes fixed test values from the setup file, so suites stop mocking it

tests/setup.ts mocks src/config once with tests/helpers/test-config.ts. A suite that needs other values calls overrideTestConfig(), and the setup file restores the defaults after every case. The 191 per-file factories are gone; config.test.ts takes the real module through vi.unmock, and the few suites that signed tokens with their own literal secret read it from TEST_CONFIG.

server/src/nest/common/api-docs.kill-switch.ts

@@ -1,7 +1,7 @@
 /**
- * API-docs kill switch (#1412). Deliberately NOT in src/config.ts: tests mock
- * that module with partial exports, and reading the env at call time keeps the
- * flag testable per-request (same pattern as plugins/kill-switch.ts).
+ * API-docs kill switch (#1412). Deliberately NOT in src/config.ts: that module
+ * is frozen at import (and replaced wholesale under test), and reading the env
+ * at call time keeps the flag testable per-request (same pattern as plugins/kill-switch.ts).
  *
  * Off by default — the generated spec enumerates every route including the
  * admin surface, so exposing it is an explicit self-hoster decision.

server/src/nest/plugins/kill-switch.ts

@@ -4,9 +4,8 @@
  * still have to be activated one by one, so no third-party code runs until an
  * admin turns a specific plugin on. Set TREK_PLUGINS_ENABLED=false to switch the
  * whole system off (installed plugins stay on disk, deactivated). Lives in its
- * own module (not config.ts) so the many tests that mock config with a partial
- * export set don't have to know about it: the plugin runtime reads the env
- * directly here. Read at call time so tests and runtime env changes take effect
+ * own module (not config.ts), whose values are frozen at import and replaced
+ * wholesale under test: the plugin runtime reads the env directly here. Read at call time so tests and runtime env changes take effect
  * immediately.
  */
 import { readEnv } from '../../app-config';