подгрузка данных для api из env

app.py

@@ -29,10 +29,19 @@ from ui_builder import install_ui_builder
 from khl_site.khl_data_center import APP as khl_site_app
 
 BASE_DIR = Path(__file__).resolve().parent
-BUILD_VERSION = "2026.08.19.23"
+BUILD_VERSION = "2026.08.19.26"
+# compatibility: BUILD_VERSION = "2026.08.19.24"
 # compatibility: BUILD_VERSION = "2026.08.19.22"
-load_dotenv(BASE_DIR / ".env.local")
-load_dotenv(BASE_DIR / ".env")
+load_dotenv(BASE_DIR / ".env.local", override=False)
+load_dotenv(BASE_DIR / ".env", override=False)
+
+# Production can keep secrets outside the Git working tree. systemd already
+# injects EnvironmentFile=/mnt/khl/.env, but this fallback also makes a manual
+# `python -m uvicorn app:app` launch read the same file. Existing process
+# environment variables always win because override=False.
+_external_env = Path(os.getenv("HOCKEY_ENV_FILE", "/mnt/khl/.env"))
+if _external_env.is_file():
+    load_dotenv(_external_env, override=False)
 VMIX_API_URL = os.getenv("VMIX_API_URL", "http://127.0.0.1:8088/api/")
 configure_hockey_vmix_settings(BASE_DIR)
 
@@ -353,4 +362,6 @@ async def legacy_runtime_redirect() -> RedirectResponse:
 
 @app.get("/ui-builder", include_in_schema=False)
 async def legacy_editor_redirect() -> RedirectResponse:
-    return RedirectResponse("/editor", status_code=302)
+    # Legacy/bookmarked UI Builder URLs should always land in the operator runtime.
+    # The editor is opened explicitly from the runtime toolbar after PIN auth.
+    return RedirectResponse("/", status_code=302)