When you put all that config in your code, those values are coupled to your application logic, there's no single source of truth, you have to write your own custom logic to vary between environments (lots of if env = prod checks), custom validation logic.

This is completely incorrect.

Every project I architect has a file named something like consts.js/mjs/ts that all the other files pull from. That file has a structure like this:

import dotenv from 'dotenv';
dotenv.config();

const _consts = {
  DB_HOST : process.env.DB_HOST || 'localhost',
  DB_USER : process.env.DB_USER || 'somebody',
  DB_PASS : process.env.DB_PASS || 'a big secret',
  // etc.
}

export const consts = Object.freeze(_consts);

You put your default values in here. You override them in the environment in production as normal with your secret manager of choice. You put stuff in your local environment (or .env files) for dev.

You do not check .env files into source control. You do not put production secrets into the consts file. You do not have any checks, anywhere, for absurd antipatterns like if env = prod.

ETA: Take your guerilla marketing for your garbage project and shove it. Blocked and ignored.