fix(hub): align Titanium env names with Keygen config

[finedesignz]

Summary

• accept canonical Keygen-prefixed Titanium env names while keeping legacy fallbacks
• document the runtime Titanium env names used by the auth cutover runbook
• add config env precedence coverage and stabilize the full hub test suite mock surface

Tests

• cd hub; bun test -> 282 pass, 63 skip, 0 fail
• cd hub; bun test test/config-env.test.ts test/titanium-client.test.ts test/auth-middleware.test.ts test/csrf.test.ts test/magic-link.test.ts test/profile-license.test.ts test/reauth.test.ts test/session.test.ts -> 58 pass, 0 fail
• cd hub; bun test test/catchup-consolidate.test.ts test/scheduler.test.ts test/schedule-rules.test.ts test/threshold.test.ts test/supervisor-auth-disambiguation.test.ts -> 86 pass, 7 skip, 0 fail
• cd web; bun run build -> passed; Vite emitted the existing large chunk warning
• git diff --cached --check -> passed; Git emitted Windows CRLF conversion warnings only