feat(env): add Zod env validation and update auth-server

Add src/lib/env.ts with runtime Zod validation for NEXT_PUBLIC_* variables. Update auth-server to use validated env instead of process.env directly.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

src/lib/auth-server.ts

@@ -1,5 +1,7 @@
 import { convexBetterAuthNextJs } from '@convex-dev/better-auth/nextjs';
 
+import { env } from './env';
+
 export const {
   handler,
   preloadAuthQuery,
@@ -9,6 +11,6 @@ export const {
   fetchAuthMutation,
   fetchAuthAction,
 } = convexBetterAuthNextJs({
-  convexUrl: process.env.NEXT_PUBLIC_CONVEX_URL!,
+  convexUrl: env.NEXT_PUBLIC_CONVEX_URL,
-  convexSiteUrl: process.env.NEXT_PUBLIC_CONVEX_SITE_URL!,
+  convexSiteUrl: env.NEXT_PUBLIC_CONVEX_SITE_URL,
 });

src/lib/env.ts

@@ -0,0 +1,35 @@
+import { z } from 'zod/v4';
+
+const serverSchema = z.object({
+  NEXT_PUBLIC_CONVEX_URL: z.string().url(),
+  NEXT_PUBLIC_CONVEX_SITE_URL: z.string().url(),
+  NEXT_PUBLIC_SITE_URL: z.string().url(),
+});
+
+const clientSchema = z.object({
+  NEXT_PUBLIC_CONVEX_URL: z.string().url(),
+  NEXT_PUBLIC_CONVEX_SITE_URL: z.string().url(),
+  NEXT_PUBLIC_SITE_URL: z.string().url(),
+});
+
+const processEnv = {
+  NEXT_PUBLIC_CONVEX_URL: process.env.NEXT_PUBLIC_CONVEX_URL,
+  NEXT_PUBLIC_CONVEX_SITE_URL: process.env.NEXT_PUBLIC_CONVEX_SITE_URL,
+  NEXT_PUBLIC_SITE_URL: process.env.NEXT_PUBLIC_SITE_URL,
+};
+
+const parsed = serverSchema.safeParse(processEnv);
+
+if (!parsed.success) {
+  console.error(
+    'Invalid environment variables:',
+    parsed.error.flatten().fieldErrors,
+  );
+  throw new Error('Invalid environment variables');
+}
+
+export const env = parsed.data;
+
+export function getClientEnv() {
+  return clientSchema.parse(processEnv);
+}