Use non-public env variables for sensitive credentials

- NEXT_PUBLIC_API_BASE: Keep public (just the endpoint URL)
- SERVER_ID: Remove NEXT_PUBLIC_ prefix (private identifier)
- ACCESS_TOKEN: Remove NEXT_PUBLIC_ prefix (sensitive credential)

Since fetching is server-side, credentials never reach the browser.
Only API_BASE needs to be public if accessed from client in future.

.env.local.example

@@ -1,3 +1,3 @@
 NEXT_PUBLIC_API_BASE=https://acc-api.jurmanovic.com/v1/api
-NEXT_PUBLIC_SERVER_ID=2ea19460-f3b6-47ae-a667-c26876425268
-NEXT_PUBLIC_ACCESS_TOKEN=EB41048A021F7A7707ED4E5EF37052C401F9ACD5DCDBC94BF16D0456FAAF111A
+SERVER_ID=2ea19460-f3b6-47ae-a667-c26876425268
+ACCESS_TOKEN=EB41048A021F7A7707ED4E5EF37052C401F9ACD5DCDBC94BF16D0456FAAF111A

src/lib/api.ts

@@ -2,8 +2,8 @@ import { AppData } from './types';
 
 export async function fetchLeaderboard(): Promise<AppData | null> {
   const API_BASE = process.env.NEXT_PUBLIC_API_BASE || '';
-  const SERVER_ID = process.env.NEXT_PUBLIC_SERVER_ID || '';
-  const ACCESS_TOKEN = process.env.NEXT_PUBLIC_ACCESS_TOKEN || '';
+  const SERVER_ID = process.env.SERVER_ID || '';
+  const ACCESS_TOKEN = process.env.ACCESS_TOKEN || '';
 
   if (!API_BASE || !SERVER_ID || !ACCESS_TOKEN) {
     console.warn('Missing API configuration');