chore(security): extract OAuth client secret to environment variable

- Add .env.example with GOOGLE_CLIENT_SECRET_B64 placeholder
- Update esbuild config to inject env vars via define at build time
- Add env.d.ts for TypeScript process.env type declarations
- Use base64 encoding for basic obfuscation of injected secrets

This prevents OAuth client secrets from being committed directly to
the repository. Developers need to create .env with their own secrets.

.env.example

@@ -0,0 +1,7 @@
+# Google OAuth Client Secret (base64 encoded)
+# For development, use your own Google Cloud Console credentials
+# See: https://developers.google.com/identity/protocols/oauth2/native-app
+GOOGLE_CLIENT_SECRET_B64=
+
+# GitHub token for releases (optional, for release-it)
+GITHUB_TOKEN=

esbuild.config.mjs

@@ -3,10 +3,14 @@ import process from "process";
 import builtins from "builtin-modules";
 import fs from "fs";
 import path from "path";
+import dotenv from "dotenv";
 
 import inlineWorkerPlugin from "esbuild-plugin-inline-worker";
 import { sassPlugin } from "esbuild-sass-plugin";
 
+// Load environment variables from .env file
+dotenv.config();
+
 // Respect release-it dry-run: skip writing build artifacts entirely
 const __D_RY__ =
 	process.env.RELEASE_IT_DRY_RUN === "1" || process.env.RELEASE_IT === "1";
@@ -94,6 +98,12 @@ const buildOptions = {
 	banner: {
 		js: banner,
 	},
+	define: {
+		// Inject base64-encoded secrets at build time (decoded at runtime)
+		"process.env.GOOGLE_CLIENT_SECRET_B64": JSON.stringify(
+			process.env.GOOGLE_CLIENT_SECRET_B64 || "",
+		),
+	},
 	minify: prod ? true : false,
 	entryPoints: ["src/index.ts"],
 	plugins: [

src/types/env.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Environment variable type declarations
+ * These values are injected at build time via esbuild's define option
+ */
+declare namespace NodeJS {
+	interface ProcessEnv {
+		/** Base64-encoded Google OAuth client secret */
+		GOOGLE_CLIENT_SECRET_B64?: string;
+	}
+}