Set up environment config and secrets across dev, staging, and production

Help me set up configuration and secrets management for my application across environments. App and stack: [LANGUAGE, framework, services - e.g. "Node API, Postgres, Redis, React frontend"] Environments: [e.g. local, preview, staging, production] Where it runs: [Docker Compose, Kubernetes, a PaaS, serverless, VMs] Current setup: [e.g. ".env files shared on Slack", "hard-coded keys", "some vars in CI"] External integrations: [payment, email, auth, storage, analytics] Secret storage available: [cloud secret manager, vault, CI secrets, PaaS env settings] Give me: 1. A configuration inventory table: Variable | Purpose | Secret? | Differs by environment? | Default for local | Where it is stored in each environment. 2. Naming conventions and a `.env.example` file with comments and placeholder values only. 3. Loading and validation: how the app reads config, fails fast at startup on missing or malformed values, and keeps a typed config object. 4. Secrets handling: where each secret lives, who can access it (least privilege), rotation steps, and how to keep secrets out of Git, Docker images, build logs, and frontend bundles (anything in a client bundle is public). 5. Docker: base compose file plus per-environment overrides, build args vs. runtime env, and multi-stage builds that don't bake in secrets. 6. CI/CD: injecting config per environment, and preventing preview builds from using production credentials. 7. A cleanup plan if secrets were already committed: rotate first, then purge history, then add secret scanning. Never print real secret values in your answer; use placeholders.