refactor(config): centralize env loading and enforce typed access

- Centralize environment variable loading in config.MustLoad
- Parse and validate all env vars once at initialization
- Make config fields private and read-only
- Remove public Getenv usage in favor of typed accessors
- Improve validation and initialization order
- Normalize enum naming to be idiomatic and avoid constant collisions

internal/config/config.go

@@ -1,33 +1,63 @@
 package config
 
-import (
-	"os"
-	"strconv"
+import "tunnel_pls/types"
 
-	"github.com/joho/godotenv"
-)
+type Config interface {
+	Domain() string
+	SSHPort() string
 
-func Load() error {
-	if _, err := os.Stat(".env"); err == nil {
-		return godotenv.Load(".env")
-	}
-	return nil
+	HTTPPort() string
+	HTTPSPort() string
+
+	TLSEnabled() bool
+	TLSRedirect() bool
+
+	ACMEEmail() string
+	CFAPIToken() string
+	ACMEStaging() bool
+
+	AllowedPortsStart() uint16
+	AllowedPortsEnd() uint16
+
+	BufferSize() int
+
+	PprofEnabled() bool
+	PprofPort() string
+
+	Mode() types.ServerMode
+	GRPCAddress() string
+	GRPCPort() string
+	NodeToken() string
 }
 
-func Getenv(key, defaultValue string) string {
-	val := os.Getenv(key)
-	if val == "" {
-		val = defaultValue
+func MustLoad() (Config, error) {
+	if err := loadEnvFile(); err != nil {
+		return nil, err
 	}
 
-	return val
+	cfg, err := parse()
+	if err != nil {
+		return nil, err
+	}
+
+	return cfg, nil
 }
 
-func GetBufferSize() int {
-	sizeStr := Getenv("BUFFER_SIZE", "32768")
-	size, err := strconv.Atoi(sizeStr)
-	if err != nil || size < 4096 || size > 1048576 {
-		return 32768
-	}
-	return size
-}
+func (c *config) Domain() string            { return c.domain }
+func (c *config) SSHPort() string           { return c.sshPort }
+func (c *config) HTTPPort() string          { return c.httpPort }
+func (c *config) HTTPSPort() string         { return c.httpsPort }
+func (c *config) TLSEnabled() bool          { return c.tlsEnabled }
+func (c *config) TLSRedirect() bool         { return c.tlsRedirect }
+func (c *config) ACMEEmail() string         { return c.acmeEmail }
+func (c *config) CFAPIToken() string        { return c.cfAPIToken }
+func (c *config) ACMEStaging() bool         { return c.acmeStaging }
+func (c *config) AllowedPortsStart() uint16 { return c.allowedPortsStart }
+func (c *config) AllowedPortsEnd() uint16   { return c.allowedPortsEnd }
+func (c *config) BufferSize() int           { return c.bufferSize }
+func (c *config) PprofEnabled() bool        { return c.pprofEnabled }
+func (c *config) PprofPort() string         { return c.pprofPort }
+func (c *config) Mode() types.ServerMode    { return c.mode }
+func (c *config) GRPCAddress() string       { return c.grpcAddress }
+func (c *config) GRPCPort() string          { return c.grpcPort }
+func (c *config) NodeToken() string         { return c.nodeToken }