- Remove import.meta.env.VITE_TLSYNC_SECRET from syncService.ts
- Add optional token parameter to SyncConnectionOptions interface
(caller passes token fetched from API, not a baked-in secret)
- Add clientEnvBlocklist in vite.config.ts to prevent sensitive VITE_
env vars (TLSYNC_SECRET, MICROSOFT_CLIENT_SECRET*) from reaching bundle
- Remove VITE_TLSYNC_SECRET from .env.example
- Token auth for TLSync now handled server-side or via API endpoint
Ref: t_99d166c6
