Fix/settings env parsing - #5

Fix server-side to get ready for live deployment

Add CI pipelines

The container never started. pydantic-settings treats list-typed fields as
complex and JSON-decodes the environment value inside the settings source,
which runs before field validators -- so CORS_ORIGINS=https://embeddings.
mannymcgrail.com failed json.loads and raised SettingsError at import,
before _split_csv ever saw it. ALLOWED_MODELS would have failed identically
on the next line.

Development never hit this because both fields fall back to default_factory
when unset, and they are only set in deployment.

Marking both fields NoDecode hands the raw string to the validator. That on
its own would have silently dropped support for JSON array values, which is
what pydantic-settings accepted before, so the validator now takes either
form. Adds test_config.py covering both, plus the exact environment
docker-compose.yml sets. Raises the pydantic-settings floor to 2.3, which
introduced NoDecode.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>