Architecture note: separating public config from secrets in Vite builds
Vite inlines VITE_-prefixed variables into the browser bundle at build time. This note covers a minimal design that keeps secrets in Node-side config, operational checks to prevent leaks, and failure modes to avoid.