feat: implement environment-based secrets management

[MikeVenge]

Summary

Secure the application by eliminating hardcoded credentials and configuration values. All secrets and environment-specific settings now load from environment variables, enabling safe deployment across local, Railway, and Vercel environments.

Changes

• Add .env.example template with comprehensive documentation for all required and optional environment variables
• Implement validate_required_env_vars() function to fail-fast on startup if critical config is missing
• Refactor backend/main.py to load GOOGLE_CLOUD_PROJECT, GOOGLE_CLOUD_LOCATION, GOOGLE_PDDL_MODEL from environment
• Support GOOGLE_APPLICATION_CREDENTIALS_JSON for direct credential injection (Railway/Vercel) and file path fallback for local development
• Move CORS configuration to ALLOWED_ORIGINS environment variable with sensible defaults
• Update pddl_planner.py to load FIREWORKS_API_KEY from environment with clear error messaging
• Add detailed startup logging that validates configuration without exposing sensitive values

Testing

• Verify startup validation fails with clear error messages when required env vars are missing
• Test local development flow: copy .env.example to .env, fill values, confirm app starts
• Test Railway deployment with environment variables set in dashboard
• Test CORS configuration with ALLOWED_ORIGINS set to specific domains
• Confirm no hardcoded credentials remain in codebase

Notes

BREAKING CHANGE: Application now requires environment variables at startup.

Required variables:

• GOOGLE_CLOUD_PROJECT
• GOOGLE_CLOUD_LOCATION
• GOOGLE_PDDL_MODEL
• Either GOOGLE_APPLICATION_CREDENTIALS_JSON or GOOGLE_APPLICATION_CREDENTIALS

Migration steps:

1. Local dev: Run cp .env.example .env and fill in your values
2. Railway: Add variables via Project → Variables dashboard
3. Vercel: Add VITE_API_URL via Settings → Environment Variables

See .env.example for detailed documentation and deployment instructions.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
pddl	Ready	Preview, Comment	Dec 19, 2025 5:13pm