refactor: extract is_production detection into a shared helper to fix divergent logic

[jmankoff]

Problem

main.py detects whether the app is running in production in two separate places, with slightly different conditions:

In validate_security_configuration() (startup):

is_production = any([
    local_settings.PRODUCTION_URL and
    "localhost" not in local_settings.PRODUCTION_URL and
    local_settings.PRODUCTION_URL.strip(),
    os.getenv("ENVIRONMENT") == "production",
    os.getenv("ENV") == "production",
])

In the /health endpoint:

is_production = any([
    "dummy" not in current_settings.SUPABASE_URL,   # ← extra condition
    current_settings.PRODUCTION_URL and ...,
    os.getenv("ENVIRONMENT") == "production",
    os.getenv("ENV") == "production",
])

The health endpoint includes an extra `"dummy" not in SUPABASE_URL` condition that the startup check does not. This means a misconfigured environment could pass the startup security check but report `"mode": "production"` in the health response (or vice versa).

Fix

Extract a single _is_production(settings) -> bool helper (no ``ENV_FILEheuristic — just PRODUCTION_URL + ENVIRONMENT checks) and call it from both places. This was identified while reviewing thepixi-dev` branch, which attempted this refactor but added a problematic `ENV_FILE == ".env"` condition.

Acceptance criteria

• Single source of truth for production detection
• Both startup validation and /health use the same function
• Existing test_unit_startup_security.py tests continue to pass
• No change to observable behavior for correct configurations