fix(config): guard env-var JSON parsing against invalid input