Guard against partial env var sets where STEP_CA_AVAILABLE=1 is set but provisioner key or root cert path are missing, which would cause CaService constructor to throw during NestJS module instantiation. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>