organize all public env build args

[HangYeung1]

Summary

• Pass every NEXT_PUBLIC_* value into the Docker build as one base64 build arg, then write it to .env.production.local before next build so Next inlines it.
• Drop those same five variables from the ECS task definition. They are public build-time config; server secrets stay in SSM.
• Keep the GitHub Actions output on one line so base64 -w0 does not glue the value to the following delimiter.

Closes #29

Test plan

• Confirm the CD "Prepare build env" step emits a single env_b64= line and the image build receives BUILD_ENV_B64.
• After deploy, confirm the client bundle has the Supabase URL, publishable key, Turnstile site key, and PostHog token/host.
• Confirm login, Supabase calls, and PostHog still work without those five variables set on the running ECS task.
• Confirm DATABASE_URL, SUPABASE_SERVICE_ROLE_KEY, LOGIN_TURNSTILE_SECRET_KEY, and the resume/SES secrets are still injected at runtime.

[arnavs-0]

small but make sure to change docs to reflect

[HangYeung1]

good shout

[HangYeung1]

Updated the docs to match this change.

docs/remote-development.md now splits app connection into build-time NEXT_PUBLIC_* values (GitHub Actions secrets → BUILD_ENV_B64 → .env.production.local) and runtime secrets that stay on the ECS task via SSM. The ownership table in docs/development.md points at the same split.