- read app_config.vapid_public_key and compare to process.env.VAPID_PUBLIC_KEY - mismatched/absent submitted key → 400 before the structural check - VAPID_PRIVATE_KEY still env-only, never compared or returned (T-12-06)
- read app_config.vapid_public_key and compare to process.env.VAPID_PUBLIC_KEY - mismatched/absent submitted key → 400 before the structural check - VAPID_PRIVATE_KEY still env-only, never compared or returned (T-12-06)