Fix a secret behind a public env prefix

Rule: `env/public-prefixed-secret`

What muster-check saw

``` HIGH NEXT_PUBLIC_STRIPE_SECRET_KEY is inlined into the client bundle src/config.ts:1 NEXT_PUBLIC_STRIPE_SECRET_KEY ``` Prefixes checked: `NEXT_PUBLIC_`, `VITE_`, `REACT_APP_`, `PUBLIC_`, `EXPO_PUBLIC_`, `NUXT_PUBLIC_`, `GATSBY_`. Flagged when the rest of the name contains SECRET, PRIVATE_KEY, PASSWORD, CREDENTIAL, `_TOKEN`, API_KEY, ACCESS_KEY, CLIENT_SECRET, WEBHOOK_SECRET or SERVICE_ROLE. Names containing PUBLISHABLE, ANON_KEY, PUBLIC_KEY, URL, DOMAIN, SITE_KEY or ending in ID are allowed.

Fix

1. Rename to drop the prefix (`STRIPE_SECRET_KEY`), read it only in server code.
2. Rotate the value; it has been in every build you shipped.
3. If the client genuinely needs something, expose a narrow server endpoint instead of the key.

Prove it's fixed

Build, then `grep -r "sk_live_\|<first chars of secret>" .next/static dist/` and expect no hits. Open DevTools > Sources and search the bundle for the variable name.

Limits

Name-based. A secret in a variable with a harmless name behind a public prefix is not caught; the value-based `secret/*` rules may still catch it.