Write load_config(env) with a required secret: if API_KEY is absent, raise ValueError(f"missing required secret(s): {missing} - inject at runtime") — a server without its secret must refuse to start, not limp. Present: return model_stage (default "production"), port (int, default 8000), and api_key_set (a bool — NEVER echo the key itself). Print the good config, then catch and print the refusal.