fix security and import validation

ecosystem.config.js

@@ -1,8 +1,30 @@
+const fs = require('fs');
+const path = require('path');
+
+function loadEnvFile(filePath) {
+  if (!fs.existsSync(filePath)) return {};
+  return fs.readFileSync(filePath, 'utf8')
+    .split(/\r?\n/)
+    .reduce((env, line) => {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith('#')) return env;
+      const idx = trimmed.indexOf('=');
+      if (idx === -1) return env;
+      const key = trimmed.slice(0, idx).trim();
+      const value = trimmed.slice(idx + 1).trim();
+      env[key] = value.replace(/^['"]|['"]$/g, '');
+      return env;
+    }, {});
+}
+
+const runtimeEnv = loadEnvFile(path.join(__dirname, '.env'));
+
 module.exports = {
   apps: [{
     name: 'gamer',
     script: 'server/app.js',
     env: {
+      ...runtimeEnv,
       NODE_ENV: 'production',
       PORT: 3000
     },