Firebase web API key — a public identifier by design (spec, Further
notes), not a secret; shipping it in the CLI is normal. The qa and
prod Flutter flavors both resolve to the app-flight-prod Firebase
project (docs/architecture/FIREBASE.md → "Two Firebase projects"),
so they'd share this key too — moot here since qa isn't a CLI env
(Endpoints.env is local | stage | prod, ADR-011). local uses the
stage value, which the Auth emulator ignores.