runtime.exs: Move DATABASE_URL to runtime config for OTP release

OTP releases evaluate config at build time, not boot time.
DATABASE_URL must be read at runtime — the kohen sets it in
K8s secrets, not at compile time.

- Created config/runtime.exs with prod-only runtime config
- DATABASE_URL, L1_MOUNT_POINT, MANNA_PROVISION_FILE, HTTP_PORT
  all readable from environment at boot
- prod.exs cleaned: removed System.get_env("DATABASE_URL") call
  (was compile-time, now in runtime.exs)
- Added http_port: 4000 to prod defaults

Without this fix, the Docker image would fail to start — the
release would not find DATABASE_URL at boot.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

vav_pipeline/config/prod.exs

@@ -2,16 +2,17 @@ import Config
 
 config :logger, level: :info
 
-# Production paths — Construction spec §4.4
+# Production defaults — Construction spec §4.4
+# Env-var overrides are in runtime.exs (evaluated at boot, not compile)
 config :vav_pipeline,
   l1_mount_point: "/mnt/torah",
   manna_provision_file: "/var/lib/shorashim/manna/today.json",
   cycle_boundary_check_interval_ms: 60_000,
-  shema_context_cache_ttl_ms: 0
+  shema_context_cache_ttl_ms: 0,
+  http_port: 4000
 
 # L3 — Production PostgreSQL
-# Construction §3.8: l3_database_url from environment variable
-# The kohen/DBA sets the connection string via DATABASE_URL
+# DATABASE_URL is set at runtime via runtime.exs
+# These are compile-time defaults only
 config :vav_pipeline, VavPipeline.Repo,
-  url: System.get_env("DATABASE_URL"),
   pool_size: 20

vav_pipeline/config/runtime.exs

@@ -0,0 +1,30 @@
+import Config
+
+# Runtime configuration — read from environment variables at boot.
+# This file is evaluated at runtime, not compile time.
+# Required for OTP releases where env vars aren't known at build time.
+
+if config_env() == :prod do
+  # L3 — PostgreSQL connection
+  # The kohen sets DATABASE_URL in the K8s secret
+  database_url =
+    System.get_env("DATABASE_URL") ||
+      raise """
+      DATABASE_URL not set.
+      The kohen must set the DATABASE_URL in shorashim-secrets.
+      Format: ecto://user:password@host:port/database?sslmode=require
+      """
+
+  config :vav_pipeline, VavPipeline.Repo,
+    url: database_url,
+    pool_size: String.to_integer(System.get_env("POOL_SIZE") || "20")
+
+  # L1 mount point — overridable via env
+  config :vav_pipeline,
+    l1_mount_point: System.get_env("L1_MOUNT_POINT") || "/mnt/torah",
+    manna_provision_file:
+      System.get_env("MANNA_PROVISION_FILE") || "/var/lib/shorashim/manna/today.json",
+    talmudic_socket_path:
+      System.get_env("TALMUDIC_SOCKET_PATH") || "/tmp/shorashim/talmudic.sock",
+    http_port: String.to_integer(System.get_env("HTTP_PORT") || "4000")
+end