chore: harden deps, env validation, admin errors, and redis warnings

Align nodemailer with Auth.js peers, bump patch deps, validate env on deploy builds, add admin error boundary, and warn when Redis is missing in production.

Co-authored-by: Cursor <[email protected]>

.env.example

@@ -50,7 +50,10 @@ DISCORD_CLIENT_SECRET=
 GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=
 
-# Optional SMTP (password reset / alert emails)
+# Preferred email provider (HTTP API). Used before SMTP when set.
+RESEND_API_KEY=
+
+# Optional SMTP fallback (password reset / alert emails)
 SMTP_HOST=
 SMTP_PORT=587
 SMTP_USER=
@@ -71,9 +74,9 @@ PAYPAL_CLIENT_ID=
 PAYPAL_SECRET=
 PAYPAL_API=https://api-m.sandbox.paypal.com
 
-# Optional Redis — enables shared caching for rate limiting and site settings,
-# allowing horizontal scaling across multiple instances. Falls back to in-process
-# Maps when unset.
+# Redis — strongly recommended in production (required for multi-instance).
+# Shared rate limiting + site-settings cache. Without it, limits are in-process
+# only and do not hold across restarts or multiple app instances.
 REDIS_URL=redis://127.0.0.1:6379
 
 # Logging level (debug | info | warn | error). Defaults to 'info' in production,