fix(docs): prefix promo encrypt/decrypt commands with vercel env run

The promo encrypt/decrypt script requires CREDIT_CATEGORIES_ENCRYPTION_KEY
which is only available through Vercel's production environment. Update all
usage examples and the CLI error message to include the
`vercel env run -e production --` prefix so developers don't encounter
missing env var errors.

Author: kilo-code-bot[bot]

src/lib/promoCreditCategories.ts

@@ -327,7 +327,7 @@ const nonSelfServicePromos: readonly NonSelfServicePromoCreditCategoryConfig[] =
  * These are decrypted at runtime to build the actual selfServicePromos array.
  *
  * To add a new promo code:
- * 1. Run: pnpm promo encrypt PROMO_CODE
+ * 1. Run: vercel env run -e production -- pnpm promo encrypt PROMO_CODE
  * 2. Copy the encrypted value and use in encrypted_credit_category
  */
 const encryptedSelfServicePromos: readonly EncryptedSelfServicePromoCreditCategoryConfig[] = [

src/scripts/encrypt-promo-codes.ts

@@ -2,10 +2,10 @@
  * Script to encrypt or decrypt promo codes.
  *
  * Run with:
- *   pnpm promo encrypt <plaintext>
- *   pnpm promo decrypt <encrypted>
+ *   vercel env run -e production -- pnpm promo encrypt <plaintext>
+ *   vercel env run -e production -- pnpm promo decrypt <encrypted>
  *
- * Requires CREDIT_CATEGORIES_ENCRYPTION_KEY environment variable to be set.
+ * Requires CREDIT_CATEGORIES_ENCRYPTION_KEY environment variable (injected via `vercel env run`).
  */
 
 import { getEnvVariable } from '@/lib/dotenvx';
@@ -21,7 +21,7 @@ if (!CREDIT_CATEGORIES_ENCRYPTION_KEY) {
 const [operation, value] = process.argv.slice(2);
 
 if (!operation || !value) {
-  console.error('Usage: pnpm promo <encrypt|decrypt> <value>');
+  console.error('Usage: vercel env run -e production -- pnpm promo <encrypt|decrypt> <value>');
   process.exit(1);
 }