fix: load local .env before evaluating config so env refs resolve

process.env.DB_PASSWORD and similar refs in shipnode.config.ts were
undefined unless the var was exported in the shell. Now loadConfig
reads the local .env file first, so credentials stay out of the
config file without breaking setup or deploy.

Author: devalade

src/config/loader.ts

@@ -1,12 +1,36 @@
 import { resolve } from 'path';
+import { readFile } from 'node:fs/promises';
 import { pathExists } from 'fs-extra';
 import { createJiti } from 'jiti';
 import type { ShipnodeConfig } from '../shared/types.js';
 import { assembleConfig } from './assembly.js';
 import { ConfigError } from '../shared/errors.js';
 import type { ShipnodeBuilder } from './builder.js';
 
+async function loadEnvIntoProcess(cwd: string): Promise<void> {
+  const envFile = resolve(cwd, '.env');
+  let raw: string;
+  try {
+    raw = await readFile(envFile, 'utf-8');
+  } catch {
+    return;
+  }
+  for (const line of raw.split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+    const eq = trimmed.indexOf('=');
+    if (eq === -1) continue;
+    const key = trimmed.slice(0, eq).trim();
+    let val = trimmed.slice(eq + 1).trim();
+    if ((val.startsWith('"') && val.endsWith('"')) || (val.startsWith("'") && val.endsWith("'"))) {
+      val = val.slice(1, -1);
+    }
+    if (!(key in process.env)) process.env[key] = val;
+  }
+}
+
 export async function loadConfig(cwd: string, configPath?: string): Promise<ShipnodeConfig> {
+  await loadEnvIntoProcess(cwd);
   const file = configPath ?? resolve(cwd, 'shipnode.config.ts');
 
   const exists = await pathExists(file);