Env var hygiene: PORTAL_BACKEND_URL missing from .env.example; DYNAMODB_STUDENT_REPORTS_TABLE_NAME unused

Two environment-variable inconsistencies found while documenting the codebase:

## 1. `PORTAL_BACKEND_URL` is required at import time but missing from `.env.example`

`app/auth/__init__.py` reads it with `os.environ["PORTAL_BACKEND_URL"]` at module import, so a missing value crashes the whole app at startup (`KeyError`), not with a 500 on first use. On Lambda this surfaces as API Gateway 502s on cold start.

It currently works locally only because of import order in `app/main.py`: `internal.db` (which calls `load_dotenv("../.env.local")`) is imported before the router that pulls in `auth`. Reordering imports would break startup.

**Fix:** add `PORTAL_BACKEND_URL=` to `.env.example`. Optionally, read the var lazily (inside the verify function) so startup doesn't depend on import order.

## 2. `DYNAMODB_STUDENT_REPORTS_TABLE_NAME` is defined but never used

It's listed in `.env.example`, but `app/db/reports_db.py` hard-codes both table names (`student_quiz_reports`, `student_quiz_reports_v2`).

**Fix:** either wire the wrapper to read table names from env (which would also unblock a real staging table), or drop the var from `.env.example` to stop suggesting it does something.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Read .env.example, app/auth/__init__.py, app/main.py, and app/db/reports_db.py to compare the documented environment variables with how they are loaded and used. Confirm the startup behavior around PORTAL_BACKEND_URL and the table-name handling. Done means the documented variables accurately match runtime behavior, with the chosen resolution for the unused DynamoDB variable reflected consistently.

Written by the indexing model from the issue text.