fix: remove hardcoded RPC API key and add to .env.example

[memosr]

Problem

A real API key is hardcoded as a fallback value in lib/circle/gateway-sdk.ts:

const arcRpcKey = process.env.ARC_TESTNET_RPC_KEY || 'c0ca2582063a5bbd5db2f98c139775e982b16919';

Since this is an open source repository, the key is publicly visible to anyone. Additionally, ARC_TESTNET_RPC_KEY was missing from .env.example, so developers had no indication this variable was required.

Fix

- const arcRpcKey = process.env.ARC_TESTNET_RPC_KEY || 'c0ca2582063a5bbd5db2f98c139775e982b16919';
+ const arcRpcKey = process.env.ARC_TESTNET_RPC_KEY;
+ if (!arcRpcKey) {
+   throw new Error("ARC_TESTNET_RPC_KEY environment variable is not set");
+ }

Also added ARC_TESTNET_RPC_KEY= to .env.example so developers know to set it.

Impact

• Security: Exposed API key removed from source code
• DX: Developers get a clear error message if the variable is missing
• Risk: Low — anyone running the app must set the env variable explicitly