feat(nextjs): support configmap env + secret env maps (back-compat)

[masterkain]

Supersedes #20.

What

• Add web.env (map) for non-secret env vars stored in the chart-managed ConfigMap.
• Add web.secretEnv (map) for secret env vars stored in the chart-managed Secret.
• Preserve existing web.extraEnvs list-of-objects behavior (back-compat); values are merged into the Secret.
• Keep default envs (AWS_SDK_CONFIG_OPT_OUT, NEXT_TELEMETRY_DISABLED) and allow overriding via web.env.

Why

• feat: add support for extra secrets and extra env variables #20 attempted to add map-style envs but was backwards-incompatible and could break pods by conditionally omitting the Secret while still referencing it from the Deployment.

Release

• Bump chart version: 1.1.13 -> 1.1.14.

Validation

• helm lint charts/nextjs
• helm template ... + kubeconform
• ct lint --target-branch main (via chart-testing container)