feat(env): enforce paired PayPal credentials in env validation

Add superRefine rule in src/env.ts ensuring that if one PayPal credential (PAYPAL_CLIENT_ID or PAYPAL_SECRET) is set in production, the other is also required, catching configuration drift at startup.

src/env.ts

@@ -112,6 +112,7 @@ const schema = z
 	})
 	.superRefine((data, ctx) => {
 		if (data.NODE_ENV !== "production") return;
+		// AUTH_SECRET
 		if (!data.AUTH_SECRET || data.AUTH_SECRET.length < 32) {
 			ctx.addIssue({
 				code: "custom",
@@ -120,6 +121,21 @@ const schema = z
 				path: ["AUTH_SECRET"],
 			});
 		}
+		// PayPal credentials must be paired.
+		if (data.PAYPAL_CLIENT_ID && !data.PAYPAL_SECRET) {
+			ctx.addIssue({
+				code: "custom",
+				message: "PAYPAL_SECRET is required when PAYPAL_CLIENT_ID is set",
+				path: ["PAYPAL_SECRET"],
+			});
+		}
+		if (!data.PAYPAL_CLIENT_ID && data.PAYPAL_SECRET) {
+			ctx.addIssue({
+				code: "custom",
+				message: "PAYPAL_CLIENT_ID is required when PAYPAL_SECRET is set",
+				path: ["PAYPAL_CLIENT_ID"],
+			});
+		}
 	});
 
 type Env = z.infer<typeof schema>;