feat: add env.mjs for centralized env validation (t3-env)

Validates all required env vars at runtime with zod schemas.
Skips validation during build via SKIP_ENV_VALIDATION flag.
Replaces scattered process.env access with typed env imports.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/editor/lib/auth.ts

@@ -1,19 +1,19 @@
 import { createAuth } from '@pascal-app/auth/server'
 import { db } from '@pascal-app/db'
 import { Resend } from 'resend'
+import { env } from '@/env.mjs'
 import { BASE_URL } from './utils'
 
 // Initialize Resend only if API key is available
-const resendApiKey = process.env.RESEND_API_KEY
-const resend = resendApiKey && resendApiKey.trim() !== '' ? new Resend(resendApiKey) : null
+const resend = env.RESEND_API_KEY ? new Resend(env.RESEND_API_KEY) : null
 
 export const auth = createAuth({
   db,
   appName: 'Pascal Editor',
   baseURL: BASE_URL,
-  secret: process.env.BETTER_AUTH_SECRET || 'build-placeholder-not-used-at-runtime',
-  googleClientId: process.env.GOOGLE_CLIENT_ID,
-  googleClientSecret: process.env.GOOGLE_CLIENT_SECRET,
+  secret: env.BETTER_AUTH_SECRET,
+  googleClientId: env.GOOGLE_CLIENT_ID,
+  googleClientSecret: env.GOOGLE_CLIENT_SECRET,
   sendMagicLink: async ({ email, url }) => {
     if (!resend) {
       console.log(`[DEV] Magic link for ${email}: ${url}`)