fix(config): validate SANDBOX_MODE environment variable explicitly

[Oyinkans0la12]

Closes #1100

Summary

Add strict validation for sandbox-related environment variables to ensure invalid configuration values are rejected during application startup instead of being silently coerced.

Problem

backend/src/config/sandbox.ts currently determines sandbox behavior from environment variables without strict schema validation. Unexpected values such as TRUE, yes, or other non-standard strings may be interpreted incorrectly, potentially enabling or disabling sandbox mode unintentionally.

Because sandbox mode controls safety-sensitive behavior, configuration errors should fail fast rather than default to unintended behavior.

Solution

This PR introduces explicit parsing and validation for sandbox-related environment variables, allowing only documented values and rejecting any unsupported input with a clear startup error.

Implementation Details

Configuration Validation

Updated:

• backend/src/config/sandbox.ts

Changes include:

• replacing implicit truthy/falsy parsing with explicit validation,
• accepting only the documented sandbox values,
• throwing descriptive configuration errors for unsupported values,
• documenting the accepted configuration values within the module.

Error Handling

Invalid configuration now produces an actionable startup error that identifies:

• the environment variable,
• the invalid value,
• the accepted values.

This prevents ambiguous configuration from reaching runtime.

Unit Tests

Added tests covering:

• valid enabled value,
• valid disabled value,
• unsupported uppercase values,
• unsupported boolean-like strings,
• empty values,
• arbitrary invalid input.

The tests verify both successful parsing and expected startup failures.

Testing

Validated with:

• unit test suite,
• lint,
• formatting checks.

Behavioral Changes

For valid configurations, behavior is unchanged.

Invalid sandbox configuration now causes the application to fail during startup with a clear error instead of silently falling back to unintended behavior.

Checklist

• Added explicit sandbox environment variable validation.
• Fail-fast behavior implemented for invalid values.
• Added unit tests for valid and invalid parsing.
• Preserved existing runtime behavior for valid configurations.
• Ready for review.

[ogazboiz]

good hardening: parseBooleanEnv accepting only true/false/unset with a descriptive startup error closes the silent-coercion hole (FALSE leaving headers enabled was nasty), defaults preserved, and the 11x3 invalid-value test matrix is thorough. merging. if you want to keep contributing, join us on Telegram: https://t.me/+DOylgFv1jyJlNzM0