[AZ-448] [AZ-449] [AZ-453] Externalize OWM config; wrap login redirect

Batch 2 of testability refactor under epic AZ-447. All three changes are
minimal-surgical and preserve production behavior.

AZ-448 (C01) — Externalize OWM API key
- src/features/flights/flightPlanUtils.ts: read VITE_OWM_API_KEY at call
  time; if unset, getWeatherData returns null (matches the existing
  try/catch fallback contract, AC-3).
- Hardcoded literal removed; grep src/ for the old key returns no hits
  (AC-2 / NFT-SEC-09 static-string check now green).
- AC-1 honored: when the key is set, the outbound URL contains
  appid=<key>.

AZ-449 (C02) — Externalize OWM base URL
- Same call site reads VITE_OWM_BASE_URL with trim-trailing-slash
  normalization; falls back to the public api.openweathermap.org/data/2.5
  endpoint when unset (AC-1).
- Stub-friendly: VITE_OWM_BASE_URL=http://owm-stub:8081/data/2.5
  redirects every call to the e2e stub (AC-2).

AZ-453 (C06) — Wrap login redirect in setNavigateToLogin accessor
- src/api/client.ts: navigateToLoginImpl module-level fn defaults to the
  existing window.location.href = '/login' write; setNavigateToLogin(fn)
  lets tests assert "redirect invoked" without globally stubbing
  window.location.
- request() now calls navigateToLoginImpl() instead of writing
  window.location directly.

Batch 1 task specs (AZ-450/451/452/454) moved from
_docs/02_tasks/todo/ to _docs/02_tasks/done/.

State pointer advanced to refactor Phase 4 (implement, batch 2 of 2).

Static checks:
- bun run tsc --noEmit: 0 errors
- grep '335799082893fad97fa36118b131f919' src/: 0 hits
- grep 'window.location.href' src/: 2 hits, both inside the
  navigateToLoginImpl default (jsdoc + the default impl body) — no
  caller writes window.location directly.

Co-authored-by: Cursor <cursoragent@cursor.com>

_docs/_autodev_state.md

@@ -6,9 +6,9 @@ step: 4
 name: Code Testability Revision
 status: in_progress
 sub_step:
-  phase: 2
-  name: refactor-phase-2-tasks-review-gate
-  detail: "epic AZ-447 + 7 tasks AZ-448..AZ-454 created"
+  phase: 4
+  name: refactor-phase-4-implement
+  detail: "batch 2 of 2 — AZ-448, AZ-449, AZ-453"
 retry_count: 0
 cycle: 1
 step_4_5_glossary_vision: confirmed