Align backend plan with codebase

lib/server/env.ts

@@ -0,0 +1,13 @@
+export function getSessionPepper(): string {
+  const secret = process.env.SESSION_SECRET;
+  if (!secret || secret.length < 16) {
+    throw new Error(
+      "SESSION_SECRET must be set (min 16 characters) for auth routes.",
+    );
+  }
+  return secret;
+}
+
+export function isDatabaseConfigured(): boolean {
+  return Boolean(process.env.DATABASE_URL?.trim());
+}