feat: jwt cache, redis health, help-ticket admin, and write rate limits

Cut Auth.js DB load with cached jwtVersion checks, surface Redis in /api/health and deploy warnings, add admin help-center ticket reply UI, rate-limit API tickets/reactions/referral claims, and revoke PATs on sign-out-everywhere.

Co-authored-by: Cursor <[email protected]>

src/lib/auth/jwt-version-cache.test.ts

@@ -0,0 +1,51 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mockFindUnique = vi.hoisted(() => vi.fn());
+const mockRedisGet = vi.hoisted(() => vi.fn());
+const mockRedisSetex = vi.hoisted(() => vi.fn());
+const mockRedisDel = vi.hoisted(() => vi.fn());
+
+vi.mock("@/lib/prisma", () => ({
+	prisma: {
+		user: { findUnique: mockFindUnique },
+	},
+}));
+
+vi.mock("@/lib/redis", () => ({
+	redis: {
+		get: mockRedisGet,
+		setex: mockRedisSetex,
+		del: mockRedisDel,
+	},
+}));
+
+describe("jwt-version-cache", () => {
+	beforeEach(() => {
+		vi.resetModules();
+		vi.clearAllMocks();
+		mockRedisGet.mockResolvedValue(null);
+		mockRedisSetex.mockResolvedValue("OK");
+		mockRedisDel.mockResolvedValue(1);
+	});
+
+	it("returns DB version and caches it", async () => {
+		mockFindUnique.mockResolvedValue({ websiteJwtVersion: 3 });
+		const { getCachedJwtVersion } = await import("./jwt-version-cache");
+		await expect(getCachedJwtVersion(42)).resolves.toBe(3);
+		expect(mockFindUnique).toHaveBeenCalledTimes(1);
+		await expect(getCachedJwtVersion(42)).resolves.toBe(3);
+		expect(mockFindUnique).toHaveBeenCalledTimes(1);
+	});
+
+	it("invalidates memory and redis entries", async () => {
+		mockFindUnique.mockResolvedValue({ websiteJwtVersion: 1 });
+		const { getCachedJwtVersion, invalidateJwtVersionCache } = await import(
+			"./jwt-version-cache"
+		);
+		await getCachedJwtVersion(7);
+		await invalidateJwtVersionCache(7);
+		expect(mockRedisDel).toHaveBeenCalled();
+		mockFindUnique.mockResolvedValue({ websiteJwtVersion: 2 });
+		await expect(getCachedJwtVersion(7)).resolves.toBe(2);
+	});
+});