refactor: centralize env config and fine-tune auth rate limits

- feat(config): created `config/env.config.js` as the single source of truth for all `process.env` variables, refactoring across routers, controllers, and utilities (`app.js`, `jwt.util.js`, `email.util.js`, `cloudinary.js`).
- fix(rate-limit): excluded `/refresh-token` and `/logout` from the strict 15-req/15-min `authLimiter` to prevent `429 Too Many Requests` errors during automatic frontend silent refreshes.
- refactor(auth): separated cookie `maxAge` configurations into independent variables (`COOKIE_REFRESH_MAX_AGE`, `COOKIE_PROFILE_MAX_AGE`) for flexible production environments.
- security(jwt): adjusted access token lifespan down to 15 minutes (`15m`) to heavily secure in-memory sessions while relying on the 30-day HttpOnly refresh token.
