Should server API key resolution ever fall back to NEXT_PUBLIC env vars?