fix: remove dead DeleteEnvVarsByAppID and add empty-key 400 test

- Remove DeleteEnvVarsByAppID() which became dead code after
  ReplaceEnvVarsByAppID() was introduced (handles deletion internally
  within its transaction).
- Add TestHandleEnvVarSaveEmptyKeyRejected to verify that POSTing a
  JSON array with an empty key returns 400 Bad Request.

Addresses review advisories on PR #158.

internal/models/env_var.go

@@ -128,17 +128,6 @@ func FindEnvVarsByAppID(
 	return envVars, rows.Err()
 }
 
-// DeleteEnvVarsByAppID deletes all env vars for an app.
-func DeleteEnvVarsByAppID(
-	ctx context.Context,
-	db *database.Database,
-	appID string,
-) error {
-	_, err := db.Exec(ctx, "DELETE FROM app_env_vars WHERE app_id = ?", appID)
-
-	return err
-}
-
 // EnvVarPair is a key-value pair for bulk env var operations.
 type EnvVarPair struct {
 	Key   string