chore: unify mobile env config into single source of truth (closes #557)

[shychips]

Summary

Unifies mobile environment configuration into a single source of truth. Previously, services/api.ts and security/env.ts read different environment variables independently, meaning a contributor could set one and silently get the other's default instead.

Changes

• services/api.ts now builds its axios instance from envConfig.apiUrl instead of reading EXPO_PUBLIC_API_BASE_URL directly
• Removed EXPO_PUBLIC_API_BASE_URL from the codebase entirely
• Added apps/mobile/.env.example documenting EXPO_PUBLIC_APP_ENV, EXPO_PUBLIC_API_URL, and EXPO_PUBLIC_RPC_URL
• validateEnv() is now called at app startup and surfaces a visible warning in development when config is missing
• Corrected the rpcUrl dev default from an EVM-style port (http://127.0.0.1:8545) to a proper Soroban RPC endpoint

Acceptance Criteria

• services/api.ts builds its axios instance from envConfig.apiUrl
• EXPO_PUBLIC_API_BASE_URL removed from the codebase
• .env.example added in apps/mobile
• validateEnv() called at app start with visible dev warning
• rpcUrl dev default corrected to Soroban endpoint

Closes #557

[drips-wave]

@shychips Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits