Post-merge: hermetic newsletter test (dev .env Supabase creds leaked into the suite)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/integration/newsletterRoute.test.js

@@ -24,7 +24,10 @@ const LISTMONK_ENV = {
   LISTMONK_TOKEN: 'tok123',
   LISTMONK_LIST_ID: '3',
 };
-const ENV_KEYS = [...Object.keys(LISTMONK_ENV), 'VYNDR_INTERNAL_KEY'];
+const ENV_KEYS = [...Object.keys(LISTMONK_ENV), 'VYNDR_INTERNAL_KEY',
+  // Hermetic: a developer .env with real Supabase creds must not make
+  // ledgerService.getModelAggregate reach for the network in this suite.
+  'SUPABASE_URL', 'SUPABASE_SERVICE_ROLE_KEY', 'SUPABASE_SERVICE_KEY'];
 
 const savedEnv = {};
 beforeAll(() => { for (const k of ENV_KEYS) savedEnv[k] = process.env[k]; });