fix: separate Google browser and server keys (#110)

Use a separate optional server key for Places and Street View, with consistent local and Pinokio configuration, server-first CLI selection, and credential isolation checks.

Original contribution by Tom-Neverwinter; reviewed and completed by Sameh Khamis.

Co-authored-by: Tom-Neverwinter <[email protected]>
Co-authored-by: Sameh Khamis <[email protected]>

.env.example

@@ -1,3 +1,6 @@
+# Local development uses one file for browser and server keys.
+# Copy to .env (ignored); this example contains names and placeholders only.
+# Only explicitly selected browser keys are injected into the client bundle.
 # God's Eye View — environment variables
 # Copy to .env and fill in your keys. On macOS the launcher can also read keys
 # from the Keychain (see README); on Linux/Windows use this file or env vars.
@@ -21,6 +24,16 @@
 # available in the map tray and as the automatic provider-failure fallback.
 # CLIENT-EXPOSED — restrict it (HTTP referrer + API restriction) in Google Cloud.
 GOOGLE_MAPS_API_KEY=
+
+# Optional: a SEPARATE Google API key for the SERVER-SIDE Google calls — Places
+# (/api/google/nearby-places, /api/google/text-search) and the CCTV Street View
+# fallback (#33). It never reaches the browser, so it can be restricted by
+# server IP (not HTTP referrer) and scoped to just Places API + Street View
+# Static API, letting the client-exposed key above stay narrowly scoped to Map
+# Tiles + Geocoding. Unset, these calls fall back to GOOGLE_MAPS_API_KEY, so a
+# single shared key keeps working — splitting is opt-in.
+# SERVER-SIDE ONLY.
+GOOGLE_MAPS_SERVER_API_KEY=
 # Optional: opt-in per-IP rate limit for the Google Places cost endpoint
 # (/api/google/nearby-places), in requests per minute.
 # DEFAULT IS UNLIMITED — unset (or 0) means no throttling, unchanged behavior.