move xfay app secret to .env

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,4 @@
+# Copy this file to .env and fill in the values.
+# .env is git-ignored and must never be committed.
+
+XFAY_APP_SECRET=

.gitignore

@@ -1 +1,2 @@
 .dart_tool/
+.env

test/file_upload_integration_test.dart

@@ -6,28 +6,29 @@ import 'dart:typed_data';
 import 'package:swarm/swarm.dart';
 import 'package:test/test.dart';
 
+import 'test_env.dart';
+
 // Well-known test key — obviously not a real user key.
 const _privKey =
     '0000000000000000000000000000000000000000000000000000000000000001';
 
-// Per-app credentials for the xfay app.
-// ignore: avoid_hardcoded_credentials (test-only, not a user secret)
 const _kAppName = 'xfay';
-const _kAppSecret =
-    'REDACTED';
 
 // Minimal valid JPEG (SOI marker only — enough for R2 to store).
 final _kTestBytes = Uint8List.fromList([0xFF, 0xD8, 0xFF, 0xD9]);
 const _kContentType = 'image/jpeg';
 
 void main() {
+  final env = loadEnv();
+  final appSecret = env['XFAY_APP_SECRET'] ?? '';
+
   late FileUploadActor actor;
 
   setUp(() {
     actor = FileUploadActor(
       privateKey: _privKey,
       appName: _kAppName,
-      appSecret: _kAppSecret,
+      appSecret: appSecret,
     );
   });
 

test/test_env.dart

@@ -0,0 +1,18 @@
+import 'dart:io';
+
+/// Loads KEY=VALUE pairs from a `.env` file at the project root.
+/// Lines starting with `#` and blank lines are ignored.
+/// Returns an empty map if the file does not exist.
+Map<String, String> loadEnv() {
+  final file = File('.env');
+  if (!file.existsSync()) return {};
+  final result = <String, String>{};
+  for (final line in file.readAsLinesSync()) {
+    final trimmed = line.trim();
+    if (trimmed.isEmpty || trimmed.startsWith('#')) continue;
+    final idx = trimmed.indexOf('=');
+    if (idx < 1) continue;
+    result[trimmed.substring(0, idx).trim()] = trimmed.substring(idx + 1).trim();
+  }
+  return result;
+}