ANTHROPIC_API_KEY=sk-ant-...
# HMAC signing key for the server-issued session cookie. Generate with:
#   python -c "import secrets; print(secrets.token_urlsafe(32))"
# If unset, a random value is generated at process start (sessions will not
# survive a restart, which is fine for local dev).
SESSION_SECRET=