test(live): stop the live suites inheriting the production database

Seven suites read .env with a bare `process.env[key] = value`, which
overwrites whatever the shell already set. That made the DATABASE_URL from
the production .env authoritative, so a single environment variable was
enough to aim them at the live hotel database:

  RUN_CATALOG_AUDIT_LIVE=1 pnpm vitest run src/lib/services/catalog-audit-repair-live.test.ts

Three of those suites then repair the catalog in place: catalog-audit-repair-live
and catalog-repair-direct-live rewrite catalog_items and delete duplicate
classnames, and clone-bulk-import-live bulk-imports every cloneable item. None
of that is undoable, and nothing in their output said the target was
production rather than a sandbox.

Added src/test/live-env.ts with one shared loader, and pointed all seven suites
at it:

- Values already in the real environment win, so an explicit DATABASE_URL on
  the command line is always respected.
- DATABASE_URL defaults to the sandbox on port 3307 rather than inheriting the
  production one from .env.
- Anything that is not loopback is treated as production and redirected.
- Reaching production requires ALLOW_PRODUCTION_LIVE_DB=1 and logs a warning
  saying the suite repairs the catalog.

Tests in src/test/live-env.test.ts run the loader against a temporary .env so
the real project file is never read, and cover the redirect, the shell
override, non-loopback detection, the opt-in and quote stripping. A second
block asserts each of the seven suites no longer contains an inline
`process.env[...] =` assignment. Verified four of them fail against the old
loader.

This does not enable the suites; they stay gated behind their RUN_* flags.
It only removes the possibility of them silently hitting production.

Unit suite: 3330 passed, 12 skipped. Typecheck and lint clean.

src/lib/services/clone-bulk-import-live.test.ts

@@ -2,9 +2,9 @@
 // Bulk-import live run: imports every cloneable item from the sources that
 // reliably serve .nitro assets (SodaStudios, Hubbly). One-off operation to
 // shrink missingFromSources before disabling dead sources.
-import { appendFileSync, existsSync, readFileSync } from "node:fs";
-import { resolve } from "node:path";
+import { appendFileSync } from "node:fs";
 import { beforeAll, describe, expect, it } from "vitest";
+import { loadEnvForLiveTests } from "@/test/live-env";
 
 const runLive = process.env.RUN_CLONE_BULK_LIVE === "1";
 const LOG = "/tmp/clone-bulk.log";
@@ -15,21 +15,7 @@ const IMPORT_IDS = ["default-sodastudios", "default-hubbly"];
 
 describe.skipIf(!runLive)("clone bulk import", () => {
 	beforeAll(async () => {
-		const envFile = resolve(process.cwd(), ".env");
-		if (existsSync(envFile)) {
-			for (const line of readFileSync(envFile, "utf8").split(/\r?\n/)) {
-				const m = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*?)\s*$/);
-				if (!m) continue;
-				let value = m[2].trim();
-				if (
-					(value.startsWith('"') && value.endsWith('"')) ||
-					(value.startsWith("'") && value.endsWith("'"))
-				) {
-					value = value.slice(1, -1);
-				}
-				process.env[m[1]] = value;
-			}
-		}
+		loadEnvForLiveTests();
 	});
 
 	it("imports clonable items from delivering sources", async () => {