config: load public cc-ci runtime environment

nix/hosts/cc-ci-orchestrator-hetzner/configuration.nix

@@ -131,7 +131,8 @@ SSHCFG
 
   # opencode web server — one shared instance; agent sessions attach to it for web visibility.
   # Serves the web UI at http://oc.commoninternet.net (via nginx below, tailscale-only).
-  # Provider creds are read from /srv/cc-ci/.testenv at startup.
+  # Public provider configuration is tracked in the cc-ci repo; credentials
+  # remain in /srv/cc-ci/.testenv.
   systemd.services.opencode-web = {
     description = "opencode web server for cc-ci agents";
     wantedBy = [ "multi-user.target" ];
@@ -141,7 +142,10 @@ SSHCFG
       Type = "simple";
       User = "loops"; Group = "users";
       WorkingDirectory = "/srv/cc-ci-orch/cc-ci";
-      EnvironmentFile = "/srv/cc-ci/.testenv";
+      EnvironmentFile = [
+        "-/srv/cc-ci/cc-ci/.env.public"
+        "/srv/cc-ci/.testenv"
+      ];
       ExecStartPre = "${pkgs.coreutils}/bin/rm -rf /tmp/opencode";
       ExecStart = "/home/loops/.local/bin/opencode serve --hostname 127.0.0.1 --port 4096";
       Restart = "on-failure";