Read secrets from .env with $env/static/private so they never ship to the browser. PUBLIC_ names, static vs dynamic, and the SvelteKit 3 rename.