[docs]: Clarify astro:env/server variable evaluation and secret handling (#12818)

Co-authored-by: Sarah Rainsberger <[email protected]>

Author: fkatsuhiro

src/content/docs/en/guides/environment-variables.mdx

@@ -279,7 +279,9 @@ There are three kinds of environment variables, determined by the combination of
    import { API_SECRET } from "astro:env/server";
    ```
 
-   By default, secrets are only validated at runtime. You can enable validating private variables on start by [configuring `validateSecrets: true`](/en/reference/configuration-reference/#envvalidatesecrets).
+   By default, all secrets are validated whenever anything is imported from the `astro:env/server` module. This means, secrets may be validated even when they are not imported. You may need to [pass dummy environment variables](#setting-environment-variables) to satisfy this validation during the build.
+
+   You can also enable validating secrets on start by [configuring `validateSecrets: true`](/en/reference/configuration-reference/#envvalidatesecrets).
 
 :::note
 **Secret client variables** are not supported because there is no safe way to send this data to the client. Therefore, it is not possible to configure both `context: "client"` and `access: "secret"` in your schema.