OPENAI_API_KEY from its env. Per-user BYOK keys are encrypted at rest on the server (AES-256-GCM) and never sent back to the browser.BYOK_VAULT_SECRET. Cleared by saving an empty value./admin.Account management is wired to Clerk on the server. For this MVP build, sign-in is disabled — your favorites and settings live in your browser. Enable Clerk in .env (CLERK_SECRET_KEY) to enable real accounts.