enonic-nextxp-integration

The fragment is ordinary compatibility documentation and contains no evidence of malware. However, its explicit recommendation to expose all ENONIC_* variables as NEXT_PUBLIC_* is a significant credential-handling risk because it may expose ENONIC_API_TOKEN to browsers. The token should remain server-side and only non-sensitive configuration should use NEXT_PUBLIC_ variables.