Reply time setting, and server settings from process.env only

Inquiries and the sent page promise a reply within the site setting
replyTime (2 days, Greg 2026-10-11). The site reads its settings through one
helper that uses process.env only, so a .env file can never be copied into the
built bundle through import.meta.env.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012aSbo2D1qP8cMFQCykf7kx

services/site/src/lib/content.ts

@@ -6,6 +6,7 @@
  * background, so a saved note shows within a minute and a slow or restarting
  * content service never takes a page down: the last good copy keeps serving.
  */
+import { env } from "./env.ts";
 import type { NoteData, NoteType } from "@gk/schema";
 import { SiteIndex } from "./site.ts";
 
@@ -27,7 +28,6 @@ export interface Redirect {
   toPath: string;
 }
 
-const env = (k: string, fallback?: string) => process.env[k] ?? import.meta.env[k] ?? fallback;
 const baseUrl = () => (env("CONTENT_URL", "http://localhost:4310") as string).replace(/\/$/, "");
 const token = () => env("CONTENT_TOKEN", "") as string;
 /** Preview only: include unpublished notes. Needs an editor or admin token; never set in production. */

services/site/src/lib/env.ts

@@ -0,0 +1,12 @@
+/**
+ * Server settings, read from process.env at run time only. Never read secrets
+ * through import.meta.env: Vite replaces it at build time and can copy every
+ * value, secrets included, into the built bundle. Set variables in the
+ * environment (Docker env_file, or the shell when running locally).
+ */
+export function env(key: string): string | undefined;
+export function env(key: string, fallback: string): string;
+export function env(key: string, fallback?: string): string | undefined {
+  const v = process.env[key];
+  return v === undefined || v === "" ? fallback : v;
+}