Two key mismatches caused silent failures in production:
1. core/config.py LLAMACLOUD_API_KEY: was reading LLAMACLOUD_API_KEY but
docker-compose passes LLAMA_CLOUD_API_KEY (official SDK name).
Now reads LLAMA_CLOUD_API_KEY with LLAMACLOUD_API_KEY as fallback.
2. core/config.py GOOGLE_API_KEY: was reading GOOGLE_API_KEY but .env /
docker-compose use GEMINI_API_KEY. Now reads GEMINI_API_KEY first.
3. docker-compose.yml: add MSAL_* aliases for AZURE_* vars so
server/config_runtime.py picks them up explicitly (not just via defaults).
4. docker-compose.yml: pass SESSION_SECRET from .env to container.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>