HMRC connection
Test vs live environments
How Hydra isolates test and live HMRC gateways so credentials never cross.
Set HMRC_ENV to test or production. API and auth base URLs are derived only from that flag.
Production mode rejects credential strings that look like test or mock keys. Rotate TOKEN_ENCRYPTION_KEY when moving from test to live.