feat: jwt cache, redis health, help-ticket admin, and write rate limits

Cut Auth.js DB load with cached jwtVersion checks, surface Redis in /api/health and deploy warnings, add admin help-center ticket reply UI, rate-limit API tickets/reactions/referral claims, and revoke PATs on sign-out-everywhere.

Co-authored-by: Cursor <[email protected]>

.gitea/workflows/deploy.yaml

@@ -288,6 +288,11 @@ jobs:
           # Production env stays on the live tree; stage only needs a symlink for build/migrate.
           ln -sfn "${LIVE}/.env" "${STAGE}/.env"
 
+          if ! grep -qE '^[[:space:]]*REDIS_URL=.+' "${LIVE}/.env" 2>/dev/null; then
+            echo "WARNING: REDIS_URL is unset in ${LIVE}/.env" >&2
+            echo "WARNING: Rate limits, site-settings cache, and JWT invalidation cache will be in-process only." >&2
+          fi
+
           cd "${STAGE}"
           rm -f tsconfig.tsbuildinfo .tsbuildinfo
           find . -maxdepth 3 -name '*.tsbuildinfo' -delete 2>/dev/null || true