Should server-side API key resolution ever fallback to NEXT_PUBLIC variables?