A deployment can carry the wallet in its environment, not on a mounted disk

The contract requires the application to serve a wallet file and hand its URL
and password to the data layer. Until now the only source was a filesystem
path, which no container has: `*.ngw` is gitignored, `COPY . .` brings none, and
nothing mounts one -- so a deployed instance served 404 where the contract
expects bytes.

`FESTIPOD_SHARED_WALLET_FILE_BASE64` carries the file itself. It is 810 bytes,
and it is not a secret: by design the application hands it to every user who
opens the app, so provisioning persistent storage would be guarding something
public. One channel for both values, nothing to mount, and a new host needs only
its variables.

Precedence is deliberate and one-directional: the path always wins when set, and
an unreadable path does NOT fall through to the base64 form. A deployment sets
exactly one; both set is a leftover, not a fallback chain. Local development and
the test harness only ever set the path, so they are untouched.

A malformed value answers 500 and names the variable. Answering 404 would have
made "configured wrong" indistinguishable from "not configured at all" -- the
confusion this codebase has spent two days removing.

Proven by serving the same wallet from each source in turn and comparing:
identical size, identical sha256. The first attempt at that proof silently
exercised the path branch, because Bun auto-loads `.env` and the variable was
already there; the checksums matched for the wrong reason. Caught, cleared, and
measured again.

.env.example

@@ -18,10 +18,19 @@
 FESTIPOD_SHARED_WALLET_PASSWORD=
 
 # Chemin vers le fichier portefeuille partagé (.ngw), absolu ou relatif à la
-# racine. Servi en téléchargement à /shared-wallet.ngw — par le build de l'app,
-# et par le serveur du harness pendant les tests.
+# racine. Servi en téléchargement à /shared-wallet.ngw. C'est la forme du DEV
+# LOCAL et du harness de TESTS : le fichier vit sur le disque de la machine.
 FESTIPOD_SHARED_WALLET_FILE=/chemin/absolu/vers/festipod-wallet.ngw
 
+# Contenu du portefeuille partagé (.ngw), encodé en base64 — deuxième source
+# pour le même fichier. C'est la forme des DÉPLOIEMENTS (conteneur) : *.ngw est
+# gitignoré, donc `COPY . .` n'en embarque aucun et rien n'en monte un ; le
+# fichier n'étant pas un secret (l'app le sert à quiconque ouvre l'app), il
+# voyage comme une variable de config. `FESTIPOD_SHARED_WALLET_FILE` est
+# prioritaire quand les deux sont renseignées — voir le commentaire dans
+# src/index.ts. Générer la valeur avec, p.ex., `base64 -w0 festipod-wallet.ngw`.
+FESTIPOD_SHARED_WALLET_FILE_BASE64=
+
 # ── Seed automatique (opt-in) ──────────────────────────────────────────────
 # Non vide => l'app amorce des données de démo dans un wallet VIDE au 1er login.
 # OFF par défaut : laisser vide en usage normal.