P0: Secrets/env management (.env.example, no client secrets)
Imported from GitHub issue El-SaMa/oma#14 by @El-SaMa.
Define env var contract; ensure service_role and provider secrets live only server-side; commit .env.example only.
Done when: client bundle contains no secrets; .env is gitignored.