minor fixes

lib/config/app_config.dart

@@ -0,0 +1,53 @@
+/// Application configuration sourced entirely from compile-time
+/// `--dart-define` flags.  No `.env` file is read at runtime, so no
+/// secrets can leak into the web bundle via asset files.
+///
+/// Every value has a sensible default so the project still builds and
+/// runs locally without specifying any flags.
+class AppConfig {
+  AppConfig._();
+
+  // -----------------------------------------------------------------
+  // Compile-time values (set via `--dart-define=<KEY>=<VALUE>`)
+  // -----------------------------------------------------------------
+
+  /// Runtime environment: `test`, `live`, etc.
+  static const String env = String.fromEnvironment(
+    'APP_ENV',
+    defaultValue: 'test',
+  );
+
+  /// Base URL of the backend API.
+  static const String baseUrl = String.fromEnvironment(
+    'BASE_URL',
+    defaultValue: 'http://localhost:6950/api',
+  );
+
+  /// Google OAuth web client ID.  This is *not* a secret — it is
+  /// intended to be embedded in public-facing web applications.
+  static const String clientId = String.fromEnvironment(
+    'CLIENTID',
+    defaultValue: '',
+  );
+
+  /// When `true` the payment gateway screens skip the real flow and
+  /// return a simulated success immediately.  Useful during development.
+  static const bool simulatePaymentSuccess = bool.fromEnvironment(
+    'SIMULATE_PAYMENT_SUCCESS',
+    defaultValue: false,
+  );
+
+  /// URL of the Mastercard Gateway checkout JavaScript bundle.
+  static const String gatewayScriptUrl = String.fromEnvironment(
+    'GATEWAY_SCRIPT_URL',
+    defaultValue:
+        'https://test-gateway.mastercard.com/static/checkout/checkout.min.js',
+  );
+
+  // -----------------------------------------------------------------
+  // Helpers
+  // -----------------------------------------------------------------
+
+  /// `true` when [env] is `live`.
+  static bool get isLive => env.toLowerCase() == 'live';
+}