The design spec said an unset token gets a 401 like a missing/wrong one;
the implementation (and the plan's own Definition of Done) has always
treated unset/misconfigured as 500, matching CRON_SECRET's own behavior.
Also extends the .env.example comment to spell out that this same value
must be set in Coolify's environment too, not just .env.local — this app
has no local PocketBase, so the token is checked against process.env on
whichever environment actually receives the request.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Dave
1b06549c91