The consumption audit only matched host:port inside a single value (a URL, DATABASE_URL), missing the very common split-var shape (X_HOST=localhost + X_PORT=1883, e.g. castle-api's mqtt config). Resolve those pairs too — factored into a shared _resolve helper. A bare *_PORT with no *_HOST is ignored so a deployment's own listen port isn't mistaken for a dependency. Adds test_audit.py.