Challenge 1: Why VITE_API_URL, Not Just API_URL — Possible Solution
====================================================================

WHY THE PREFIX IS REQUIRED
------------------------------
Per this chapter's own explanation, Vite only exposes environment
variables prefixed with VITE_ to client-side code. This is described
as "a deliberate, security-conscious default that prevents
accidentally leaking server-only secrets into a bundle shipped to
every user's browser." A .env file might reasonably contain BOTH
values genuinely meant to reach the browser (like a public API URL)
AND values that must never leave the server or build environment
(like a database password or a private API key). Requiring an
explicit VITE_ prefix means a developer has to deliberately OPT IN a
variable to client exposure, rather than every single environment
variable being exposed by default and risking an accidental leak of
something sensitive.

WHAT WOULD HAPPEN WITHOUT THE PREFIX
------------------------------
If the variable were named API_URL instead of VITE_API_URL, Vite
would simply NOT expose it to the client-side code at all.
import.meta.env.API_URL would be undefined inside main.js — not an
error, just silently missing. The capstone's own line
`const apiUrl = import.meta.env.VITE_API_URL;` would end up assigning
undefined to apiUrl, and any code depending on that value (like
passing it to openSettingsPanel) would receive undefined instead of
the intended URL string, likely causing a runtime failure somewhere
downstream when that value is actually used.

WHY THIS WORKS AS AN ANSWER
------------------------------
It explains the actual security-motivated reason behind the VITE_
prefix requirement using the chapter's own stated rationale, and
traces the concrete consequence of omitting it (silent undefined,
not an error) through to this capstone's own specific line of code.