Amplify: wire STAFF_REPORT_KEY into build env + .env.production

Without this, even after setting STAFF_REPORT_KEY in the Amplify Secrets
tab the value never reaches the SSR Lambda — the build script only writes
the listed env vars into .env.production, which is what Next bundles.

amplify.yml

@@ -36,12 +36,12 @@ applications:
                   echo "[secrets] $name resolved from SSM ($path)"
                 fi
               }
-              for v in CIVI_API_KEY CIVI_SITE_KEY CIVI_HTTP_AUTH_PASS HEALTH_TOKEN PREVIEW_ADMIN_TOKEN; do
+              for v in CIVI_API_KEY CIVI_SITE_KEY CIVI_HTTP_AUTH_PASS HEALTH_TOKEN PREVIEW_ADMIN_TOKEN STAFF_REPORT_KEY; do
                 fetch_secret "$v"
               done
             - |
               # Length-only diagnostic (no values leaked to the log).
-              for v in CIVI_BASE_URL CIVI_API_KEY CIVI_SITE_KEY CIVI_HTTP_AUTH_USER CIVI_HTTP_AUTH_PASS HEALTH_TOKEN PREVIEW_ADMIN_TOKEN; do
+              for v in CIVI_BASE_URL CIVI_API_KEY CIVI_SITE_KEY CIVI_HTTP_AUTH_USER CIVI_HTTP_AUTH_PASS HEALTH_TOKEN PREVIEW_ADMIN_TOKEN STAFF_REPORT_KEY; do
                 val="${!v}"
                 if [ -n "$val" ]; then
                   echo "[env check] $v set (${#val} chars)"
@@ -75,6 +75,7 @@ applications:
                 echo "CIVI_HTTP_AUTH_PASS=$CIVI_HTTP_AUTH_PASS"
                 echo "HEALTH_TOKEN=$HEALTH_TOKEN"
                 echo "PREVIEW_ADMIN_TOKEN=$PREVIEW_ADMIN_TOKEN"
+                echo "STAFF_REPORT_KEY=$STAFF_REPORT_KEY"
               } > .env.production
         build:
           commands: