How should env examples handle server-only API key contracts when runtime has permissive fallbacks?