feat(decorations): allow VITE_DECORATION_CDN override; close N127

- avatarDecorations: resolve the decoration CDN base from VITE_DECORATION_CDN at
  runtime, falling back to the DECORATION_CDN literal (kept intact so the sync
  script + tests still parse it). Lets a deploy repoint the CDN without a code
  edit. Guarded for the tsx test runner (import.meta.env undefined there).
- LOTUS_BUGS: close N127 — the denoise dev-injection gap dissolved with the A7
  cutover (no getUserMedia shim is injected anymore; denoise is in-source in the
  EC fork), so there is nothing to inject in dev.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/features/lotus/avatarDecorations.ts

@@ -6,6 +6,15 @@
 export const DECORATION_CDN =
   'https://drive.lotusguild.org/public.php/dav/files/bHswJ9pNKp2t26N/cinny-decorations';
 
+// Runtime base. A deployment can repoint the decorations at a different host
+// without editing the catalog literal above (which scripts/syncDecorations.mjs
+// and the build read) by setting `VITE_DECORATION_CDN`; otherwise it falls back
+// to DECORATION_CDN. `import.meta.env` is undefined under the tsx test runner,
+// hence the guard. Trailing slashes are trimmed so `decorationUrl` stays clean.
+const envDecorationCdn = (import.meta as unknown as { env?: Record<string, string | undefined> })
+  .env?.VITE_DECORATION_CDN;
+const RESOLVED_DECORATION_CDN = (envDecorationCdn || DECORATION_CDN).replace(/\/+$/, '');
+
 export type AvatarDecoration = {
   slug: string;
   name: string;
@@ -180,5 +189,5 @@ export const ALL_DECORATIONS: AvatarDecoration[] = DECORATION_CATEGORIES.flatMap
 );
 
 export function decorationUrl(slug: string): string {
-  return `${DECORATION_CDN}/${slug}.png`;
+  return `${RESOLVED_DECORATION_CDN}/${slug}.png`;
 }