refactor: remove dotenv dependency and use env.ts pattern

[pyramation]

refactor: remove dotenv dependency and use env.ts pattern

Summary

This PR removes the dotenv dependency from graphql/server and migrates to the existing env.ts/merge.ts pattern used throughout the codebase. The server already uses getEnvOptions() from @constructive-io/graphql-env, so the dotenv/config import was redundant.

Changes:

• Remove import 'dotenv/config' from server.ts and create-bucket.ts
• Refactor create-bucket.ts to use getEnvOptions() for CDN configuration
• Remove dotenv dependency from package.json
• Delete committed graphql/server/.env file (contained hardcoded dev credentials)
• Add AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY aliases to pgpm/env/src/env.ts for standard AWS env var compatibility
• Add .env and .env.local to root .gitignore

Review & Testing Checklist for Human

• Verify local dev workflow: After pulling this branch, ensure you can start the server by setting env vars manually (e.g., PGHOST, PGUSER, etc.) or via pgpm.config.js/pgpm.json config files
• Test create-bucket script: Run pnpm bucket:create in graphql/server with appropriate env vars set to verify S3/MinIO bucket creation still works
• Verify PGDATABASE handling: The user mentioned a bug where PGDATABASE was being ignored - confirm this is resolved by setting PGDATABASE=mydb and verifying the server connects to the correct database
• Check AWS env var aliases: Test that both AWS_ACCESS_KEY and AWS_ACCESS_KEY_ID work correctly (same for secret key)

Recommended test plan:

export PGHOST=localhost PGPORT=5432 PGUSER=postgres PGPASSWORD=password PGDATABASE=testdb
cd graphql/server
pnpm dev  # verify server starts and connects to correct DB

Notes

• Legacy test fixtures under __fixtures__/sqitch/ were intentionally left unchanged as they are not part of the pnpm workspace
• The lockfile diff is large due to removing the dotenv dependency tree

Link to Devin run: https://app.devin.ai/sessions/6f190395b28142c48b03080c67ec8b59
Requested by: Dan Lynch (@pyramation)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring