Add secret management guidance and config safety checks for sensitive environment variables

[David-patrick-chuks]

Summary

Improve the handling and documentation of sensitive environment variables so contributors and operators are less likely to misconfigure secrets.

Context

As the backend adds more infrastructure and integration points, the distinction between safe config and sensitive config should become clearer.

Scope

• Identify sensitive environment variable categories
• Add safety-oriented configuration guidance
• Introduce validation or warning patterns where appropriate
• Document how secrets should be handled in local vs deployment contexts

Acceptance Criteria

• Sensitive configuration categories are clearly documented
• The codebase has better safety guidance around secrets
• Contributors can distinguish between ordinary config and sensitive config
• The solution fits existing env validation patterns

Out of Scope

• External secret manager integrations
• Platform-specific deployment tooling

Dependencies

Pairs well with #6 and #21.
Stronger configuration architecture and contributor documentation will make this guidance more effective.