feat: add env.mjs for centralized env validation (t3-env)

Validates all required env vars at runtime with zod schemas.
Skips validation during build via SKIP_ENV_VALIDATION flag.
Replaces scattered process.env access with typed env imports.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/editor/lib/auth.ts

@@ -1,19 +1,19 @@
 import { createAuth } from '@pascal-app/auth/server'
 import { db } from '@pascal-app/db'
 import { Resend } from 'resend'
+import { env } from '@/env.mjs'
 import { BASE_URL } from './utils'
 
 // Initialize Resend only if API key is available
-const resendApiKey = process.env.RESEND_API_KEY
-const resend = resendApiKey && resendApiKey.trim() !== '' ? new Resend(resendApiKey) : null
+const resend = env.RESEND_API_KEY ? new Resend(env.RESEND_API_KEY) : null
 
 export const auth = createAuth({
   db,
   appName: 'Pascal Editor',
   baseURL: BASE_URL,
-  secret: process.env.BETTER_AUTH_SECRET || 'build-placeholder-not-used-at-runtime',
-  googleClientId: process.env.GOOGLE_CLIENT_ID,
-  googleClientSecret: process.env.GOOGLE_CLIENT_SECRET,
+  secret: env.BETTER_AUTH_SECRET,
+  googleClientId: env.GOOGLE_CLIENT_ID,
+  googleClientSecret: env.GOOGLE_CLIENT_SECRET,
   sendMagicLink: async ({ email, url }) => {
     if (!resend) {
       console.log(`[DEV] Magic link for ${email}: ${url}`)

apps/editor/lib/supabase/server.ts

@@ -1,8 +1,6 @@
 import { createClient } from '@supabase/supabase-js'
 import type { SupabaseDatabase } from '@pascal-app/db'
-
-const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL || 'https://placeholder.supabase.co'
-const supabaseServiceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY || 'placeholder'
+import { env } from '@/env.mjs'
 
 /**
  * Supabase client for server-side use with service role key
@@ -10,8 +8,8 @@ const supabaseServiceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY || 'placeho
  * Always filter by user_id to enforce permissions
  */
 export const supabaseAdmin = createClient<SupabaseDatabase>(
-  supabaseUrl,
-  supabaseServiceRoleKey,
+  env.NEXT_PUBLIC_SUPABASE_URL,
+  env.SUPABASE_SERVICE_ROLE_KEY,
   {
     auth: {
       persistSession: false,