feat: jwt cache, redis health, help-ticket admin, and write rate limits

Cut Auth.js DB load with cached jwtVersion checks, surface Redis in /api/health and deploy warnings, add admin help-center ticket reply UI, rate-limit API tickets/reactions/referral claims, and revoke PATs on sign-out-everywhere.

Co-authored-by: Cursor <[email protected]>

.env.example

@@ -74,9 +74,10 @@ PAYPAL_CLIENT_ID=
 PAYPAL_SECRET=
 PAYPAL_API=https://api-m.sandbox.paypal.com
 
-# Redis — strongly recommended in production (required for multi-instance).
-# Shared rate limiting + site-settings cache. Without it, limits are in-process
-# only and do not hold across restarts or multiple app instances.
+# Redis — REQUIRED for production (shared rate limits, site-settings cache,
+# JWT session invalidation cache). Without REDIS_URL the app falls back to
+# in-process memory: limits reset on restart and do not work across instances.
+# Deploy logs a loud warning when this is unset in production.
 REDIS_URL=redis://127.0.0.1:6379
 
 # Logging level (debug | info | warn | error). Defaults to 'info' in production,