Environment Variables and Secrets in Next.js: What Goes Wrong and How to Fix It

The rules for NEXT_PUBLIC_ vs server-only variables, how to validate at startup, and the secrets management setup I use in production.