Document missing env vars and add a CI check for the invariant

[Otfrugger]

closes #164

Summary

The issue's premise was that apps/api/src/env.ts is the single reader of process configuration. That's no longer true — grepping apps/api/src for process.env. (excluding env.ts itself) turned up six more files reading env vars directly: routes/telemetry.ts, routes/webhooks.ts, services/webhook-sender.ts, services/container.ts, services/secret-crypto.ts, services/ssrf-guard.ts. Most of those reads (TELEMETRY_TOKEN, WEBHOOK_SECRET_ENCRYPTION_KEY, NODE_ENV) were already fine or already documented, but three were not: WEBHOOK_HOST_ALLOWLIST, ANCHOR_PROBE_FAILURE_THRESHOLD, ANCHOR_PROBE_COOLDOWN_MS. I've scoped the fix (and the new check) to all of apps/api/src, not just env.ts, so this doesn't just recreate the same gap for those files.

.env.example additions (commented, with default + one-line effect)

• RATE_LIMIT_STRICT_WINDOW_MS / RATE_LIMIT_STRICT_MAX
• TRUST_PROXY_HOPS — carries the exact blank-value footgun warning from docs/MAINNET.md (TRUST_PROXY_HOPS= parses to 0, silently collapsing every client into one rate-limit bucket)
• REDIS_URL, DEFAULT_SELLER_WALLET (previously prose-only, now a real line), DEFAULT_SELLER_NAME
• WEBHOOK_HOST_ALLOWLIST, ANCHOR_PROBE_FAILURE_THRESHOLD, ANCHOR_PROBE_COOLDOWN_MS
• WATCHER_CONCURRENCY, WATCHER_MAX_ACCOUNTS_PER_TICK, WATCHER_CIRCUIT_BREAKER_THRESHOLD, WATCHER_CIRCUIT_BREAKER_COOLDOWN_MS, WATCHER_IDLE_BACKOFF_TICKS, WATCHER_AGGRESSIVE_POLL_TICKS (noted as currently unused by the watcher loop — isNewAccount bypasses backoff entirely instead of consulting this var)
• SHUTDOWN_TIMEOUT_MS

None of these need a .env.public.example entry: per that file's own header ("lists only what differs from .env.example, plus everything the guardrails make mandatory"), TRUST_PROXY_HOPS, DEFAULT_SELLER_WALLET and REDIS_URL are already there, and the rest don't have mainnet-specific defaults.

CI check

Added scripts/check-env-docs.mjs, mirroring the existing scripts/check-domain-boundary.mjs pattern (dependency-free .mjs, regex scan, process.exit(1) with actionable output). It scans apps/api/src for process.env.X reads and fails if X has no matching X= line in .env.example or .env.public.example, with an explicit exemption list (currently NODE_ENV, RENDER_EXTERNAL_HOSTNAME — both platform-injected, not operator-set). Wired into package.json as docs:check-env-docs and into .github/workflows/ci.yml alongside the other docs:check-* steps.

Verification

• Ran node scripts/check-env-docs.mjs directly (Node is available in this environment; pnpm/turbo/vitest are not) — passes clean against the updated .env.example.
• Byte-scanned every changed file for stray control bytes before committing — none found.
• Could not run: pnpm typecheck, pnpm test, or the full pnpm docs:check-env-docs via the turbo/pnpm pipeline, since no pnpm/turbo install is available here. Please run those before merging — the standalone node scripts/check-env-docs.mjs invocation above is the only local verification I could do.

Caveats

• Scope is larger than the issue's literal variable list (added the 3 self-discovered vars above) — flagging in case that's more than intended.
• WATCHER_AGGRESSIVE_POLL_TICKS is documented honestly as unused dead config rather than inventing behavior for it; may be worth a separate follow-up to either wire it up or remove it.

[drips-wave]

@Otfrugger Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[vercel]

@Otfrugger is attempting to deploy a commit to the determined's projects Team on Vercel.

A member of the Team first needs to authorize it.