Env validation + structured error logs

[akshitkrnagpal]

Summary

Stops the cryptic `atob() called with invalid base64-encoded data` errors that show up deep in the dispatch consumer when an env var is missing or malformed. New validation surfaces the variable name + a non-secret reason at three entry points + via `/health/deep`.

Why

Today the path is:

1. `ENCRYPTION_KEY` is undefined on `edgepush-api`
2. Every queued message tries to decrypt → `atob(undefined)` → `InvalidCharacterError`
3. Operator sees one log line per job, none of which name the env var
4. Operator has to read crypto.ts and trace the call chain to figure it out

After this PR:

1. Queue consumer validates env at batch start
2. Logs `[dispatch] env validation failed: ENCRYPTION_KEY `
3. Whole batch retries (drains automatically once the secret is fixed)

Same for HTTP routes (`onError` returns 503 with structured detail) and cron (validation at scheduled-event entry).

Changes

• `packages/server/src/lib/env-validation.ts` — new module. `EnvValidationError` class with `variable` + `reason` fields. `validateBase64`, `validateRequired`, `validateRequiredEnv`, `checkRequiredEnv` (collects all errors instead of throwing on the first).
• `packages/server/src/lib/crypto.ts` — `importKey` delegates base64 length check to `validateBase64` so the error always names `ENCRYPTION_KEY`.
• `packages/server/src/index.ts` — Hono `onError` handler converts `EnvValidationError` → 503 `{ error: "server_misconfigured", variable, reason }`. Adds `env` component to `/health/deep` results so operators can probe configuration explicitly.
• `packages/server/src/dispatch.ts` — validates env at batch start. Wraps per-app errors with `EnvValidationError` detection.
• `packages/server/src/cron.ts` — validates env at scheduled-event entry.
• `packages/server/src/lib/env-validation.test.ts` — 19 unit tests including coverage for the "variable name appears, value never appears" log-safety property.

Operational notes

• Reasons are bounded to: `"missing or empty"`, `"not valid base64 (length N, contains characters outside [A-Za-z0-9+/=])"`, `"decoded to N bytes, expected M"`. Length is fine to expose; the value is not. Tests assert the value never leaks into the message.
• The server package didn't have vitest set up, so `*.test.ts` is excluded from the server tsconfig. Tests run via `pnpm exec vitest run` from `packages/server`. Proper vitest config + test target as a follow-up.

Test plan

• `pnpm typecheck` clean across the monorepo
• `pnpm lint` clean
• `pnpm exec vitest run src/lib/env-validation.test.ts` — 19/19 pass
• After merge, hit `/health/deep` on edgepush-api with `OPERATOR_PROBE_TOKEN` to verify the new `env` component returns `status: ok`
• Optional: temporarily set a malformed `ENCRYPTION_KEY` on a preview deploy and confirm `/health/deep` returns `status: down, detail: ENCRYPTION_KEY: ...`

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith with what you need.}

• Let Codesmith autofix CI failures and bot reviews

[akshitkrnagpal]

Code Review Summary

Verdict: Changes requested

Blocking

• packages/server/src/index.ts:48 — HTTP requests never call parseEnv(c.env). The new app.onError only formats EnvValidationErrors thrown later, but BETTER_AUTH_SECRET / BETTER_AUTH_URL are read by createAuth() without going through the new validator. So /api/auth/** can still fail with library/default behavior instead of the promised structured 503, and a missing auth secret may not be caught at all. Add request-surface validation before protected/API handlers, or validate inside createAuth() with the new schema.

Verified

• CI check ci is completed/success on 2a64c5c.
• Local: corepack pnpm --filter @edgepush/server typecheck
• Local: corepack pnpm --filter @edgepush/server exec vitest run src/lib/env.test.ts (13 passed)