Amplify: write env vars + secrets to .env.production at build time

Amplify Gen 2 exposes Environment Variables and Secrets in the build shell
but does not inject them into the SSR Lambda runtime. Writing them to
.env.production during preBuild lets Next.js bundle them into the server
output so process.env reads work at request time.

amplify.yml

@@ -9,6 +9,20 @@ applications:
             # Tailwind plugins which live in devDependencies; without it,
             # NODE_ENV=production in the Amplify env causes npm to skip them.
             - npm ci --include=dev --cache .npm --prefer-offline
+            # Amplify exposes Environment Variables + Secrets in the build
+            # shell but does NOT inject them into the SSR Lambda runtime.
+            # Write them to .env.production so Next.js bundles them into
+            # the server output. .env* is gitignored.
+            - |
+              {
+                echo "CIVI_BASE_URL=$CIVI_BASE_URL"
+                echo "CIVI_API_KEY=$CIVI_API_KEY"
+                echo "CIVI_SITE_KEY=$CIVI_SITE_KEY"
+                echo "CIVI_HTTP_AUTH_USER=$CIVI_HTTP_AUTH_USER"
+                echo "CIVI_HTTP_AUTH_PASS=$CIVI_HTTP_AUTH_PASS"
+                echo "HEALTH_TOKEN=$HEALTH_TOKEN"
+                echo "PREVIEW_ADMIN_TOKEN=$PREVIEW_ADMIN_TOKEN"
+              } > .env.production
         build:
           commands:
             - npm run build