Sandbox env vars ready

Severity: Critical

Check automatically:

1. Look for files: .env.example, .env.sample, .env.development, env.example, .env
2. If .env is committed, verify it contains only sandbox keys (no real secrets)
3. Warn if .env.local is committed - this should never be in repo (contains personal overrides)
4. Verify example file contains actual values (not just empty API_KEY=)
5. Compare against what the app actually requires (check code for process.env.X or equivalent)

Pass criteria:

• Env example file exists (or .env with sandbox values)
• Contains all required variables with working sandbox/example values
• A developer can copy to .env (or use committed .env) and run without edits
• No .env.local committed

Fail criteria:

• No env example file at all
• .env.local is committed
• .env contains real secrets (not sandbox)
• Required variables missing from example

---