Environment variables in the backend code are used in several contexts ...

• platform to execution environments in staging/production
• local development
  • Flask app
  • utility scripts (backend/scripts)
• GitHub Action automation

They are used for multiple purposes

• passing secrets (e.g. API key, DB password)
• configuration (e.g. model, reasoning effort, DB hostname)

They are (partially) read (and therefore required) in many files

• .github/workflows/deploy.yml
• backend/.env{.example}
• backend/tenantfirstaid/shared.py
• ad-hoc in several other files

It is also hard to know (without a bunch of archeology) whether an old environment variable is no longer needed.

Suggested good practices

• consolidate reading environment variables into a single location
• define a clear merge/resolution priority between defaults, variables passed from the environment and .env (and possibly CLI args) - handle both
  - [ ] missing assignments (i.e. defaults)
  - [ ] duplicate/conflicting assignments
• resolved values should be contained and read from an immutable data structure to avoid inconsistencies (and avoids bugs like accidentally writing instead of reading a variable)
• generate documentation and artifacts for other flows so that maintenance (adding/removing environment variables) is in a single source