Refactor EPP request models and clarify environment configuration

[Hou (SciencePotato)]

Summary

• Introduce readable request/configuration models: JavaScript AppConfig and DeliveryContext, Python dataclasses, and named .NET response records with parsing at the HTTP boundary.
• Preserve API-key provider authentication, mandatory platform Easy Auth, original compact JWE handling, evaluation without provider I/O, and synchronous provider acceptance before nonce acknowledgement.
• Fix .NET validation of non-string decrypted required fields and align Python's unexpected-handler error response.
• Standardize published naming on EPP without changing external JSON fields, the envelope version, provider routes, or existing Azure resource names.
• Document environment-variable names, object-property mapping, local host settings placement, legacy ignored settings, managed-identity constraints, and the future squash-and-delete PR workflow.

Verification

• JavaScript: 17 tests passed.
• Python: 18 tests passed.
• .NET: 20 tests passed; application build passed.
• Shared JWE/validation fixtures, response wire-format, evaluation, timeout, privacy and provider-contract tests pass.
• All three README configuration examples parse successfully; formatting checks pass.
• No remaining CYOT naming in tracked source/docs/tests. Private local settings, keys, deployment checkpoints and diagnostic helpers are excluded.

Deployment evidence and limits

The object-model build was deployed to the existing three test Function Apps and active package hashes verified. A subsequent test session recorded nine accepted submissions across three runtimes and three configured providers. Original app settings/auth policies and temporary-credential cleanup have been verified.

Provider acceptance is not proof of handset receipt or latency compliance. Two previously observed Python requests exceeded the 3.2-second caller budget. The final naming/documentation and Python generic-error follow-ups in this PR have offline validation but have not been redeployed.

No OAuth implementation, Bicep, deployment workflow, provider endpoint migration, branch deletion or history rewrite is included. Prefer Squash and merge, then delete this PR branch after merge.