B2_APP_KEY_ID / B2_APP_KEY, their principal-mode
B2_CREDENTIAL_<REF>_APP_KEY(_ID) form, and the customer-hosted _FILE
secret-file variants of both are no longer read (issue #386). Without this
signal an operator whose deploy manifest still exports them gets a silent
behavior change: the legacy separate-S3-key override is dropped and the
application key signs S3 directly. The guard fires once so HTTP request paths
do not spam logs.
Warn once at startup when a removed credential alias env var is still set.