[AZ-448] [AZ-449] [AZ-453] Externalize OWM config; wrap login redirect

Batch 2 of testability refactor under epic AZ-447. All three changes are
minimal-surgical and preserve production behavior.

AZ-448 (C01) — Externalize OWM API key
- src/features/flights/flightPlanUtils.ts: read VITE_OWM_API_KEY at call
  time; if unset, getWeatherData returns null (matches the existing
  try/catch fallback contract, AC-3).
- Hardcoded literal removed; grep src/ for the old key returns no hits
  (AC-2 / NFT-SEC-09 static-string check now green).
- AC-1 honored: when the key is set, the outbound URL contains
  appid=<key>.

AZ-449 (C02) — Externalize OWM base URL
- Same call site reads VITE_OWM_BASE_URL with trim-trailing-slash
  normalization; falls back to the public api.openweathermap.org/data/2.5
  endpoint when unset (AC-1).
- Stub-friendly: VITE_OWM_BASE_URL=http://owm-stub:8081/data/2.5
  redirects every call to the e2e stub (AC-2).

AZ-453 (C06) — Wrap login redirect in setNavigateToLogin accessor
- src/api/client.ts: navigateToLoginImpl module-level fn defaults to the
  existing window.location.href = '/login' write; setNavigateToLogin(fn)
  lets tests assert "redirect invoked" without globally stubbing
  window.location.
- request() now calls navigateToLoginImpl() instead of writing
  window.location directly.

Batch 1 task specs (AZ-450/451/452/454) moved from
_docs/02_tasks/todo/ to _docs/02_tasks/done/.

State pointer advanced to refactor Phase 4 (implement, batch 2 of 2).

Static checks:
- bun run tsc --noEmit: 0 errors
- grep '335799082893fad97fa36118b131f919' src/: 0 hits
- grep 'window.location.href' src/: 2 hits, both inside the
  navigateToLoginImpl default (jsdoc + the default impl body) — no
  caller writes window.location directly.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/features/flights/flightPlanUtils.ts

@@ -56,9 +56,18 @@ export function calculateDistance(
   return ascentVertical + horizontalDistance + descentVertical
 }
 
+const DEFAULT_OWM_BASE_URL = 'https://api.openweathermap.org/data/2.5'
+
+function getOwmBaseUrl(): string {
+  const raw = import.meta.env.VITE_OWM_BASE_URL
+  if (!raw) return DEFAULT_OWM_BASE_URL
+  return raw.replace(/\/+$/, '')
+}
+
 export async function getWeatherData(lat: number, lon: number) {
-  const apiKey = '335799082893fad97fa36118b131f919'
-  const url = `https://api.openweathermap.org/data/2.5/weather?lat=${lat}&lon=${lon}&appid=${apiKey}&units=metric`
+  const apiKey = import.meta.env.VITE_OWM_API_KEY
+  if (!apiKey) return null
+  const url = `${getOwmBaseUrl()}/weather?lat=${lat}&lon=${lon}&appid=${apiKey}&units=metric`
   try {
     const res = await fetch(url)
     const data = await res.json()