fix(bootstrap): add bounds check to extractBalancedBraceContent

Return null when startPos exceeds string length to prevent out-of-bounds
access. Add comprehensive test coverage for environment variable parsing
edge cases.

bootstrap/helpers/services.php

@@ -28,6 +28,9 @@ function collectRegex(string $name)
 function extractBalancedBraceContent(string $str, int $startPos = 0): ?array
 {
     // Find opening brace
+    if ($startPos >= strlen($str)) {
+        return null;
+    }
     $openPos = strpos($str, '{', $startPos);
     if ($openPos === false) {
         return null;