Environment variables

Read on the server during SSR. Only WEBJS_PUBLIC_-prefixed names are exposed to the browser; the rest stay server-side.

• NODE_ENV = production (defined both sides)
• WEBJS_PUBLIC_APP_NAME = (unset, add WEBJS_PUBLIC_APP_NAME to .env)

Never read a secret in a page, layout, or component that ships to the browser. Keep secret reads in .server.ts files, and validate required vars at boot with app/env.ts.