Environment Configuration

Non-sensitive configuration loaded from the backend .env via python-dotenv. Secret values are masked — the browser never receives the real API key, secret or passwords, and there is no endpoint that dumps the full environment.