fix(export): restrict provider endpoint overrides to loopback test servers

The endpoint overrides are read through `$env/dynamic/private`, so they are
evaluated per request in production, not baked in at build time. That made a
single injected environment variable enough to redirect the authorization-code
and refresh-token POSTs - which carry the OAuth client secret and the user's
refresh token - to an arbitrary host, and to redirect the user's authorize hop
to an arbitrary URL.

Overrides are now ignored unless ALLOW_PROVIDER_ENDPOINT_OVERRIDES is exactly
"true" and the value is a loopback URL. `npm run test:bdd` sets the flag;
nothing else should. resolveProviderEndpoints is pure so the refusals are unit
tested, including near-miss hosts such as http://127.0.0.1.example.

Also drops the unused `pokedex` parameter from buildCsv rather than silencing it
with `void`, and the dead hasGigantamaxed field from its fallback record.

tests/support/envStub.ts

@@ -0,0 +1,5 @@
+/**
+ * Stands in for `$env/dynamic/private` so modules that reach for runtime env can be unit
+ * tested. Vitest maps the virtual module here; see vitest.config.mts.
+ */
+export const env: Record<string, string | undefined> = process.env;