chore: harden deps, env validation, admin errors, and redis warnings

Align nodemailer with Auth.js peers, bump patch deps, validate env on deploy builds, add admin error boundary, and warn when Redis is missing in production.

Co-authored-by: Cursor <[email protected]>

src/env.ts

@@ -69,7 +69,8 @@ const schema = z.object({
 	PAYPAL_CLIENT_ID: z.string().optional(),
 	PAYPAL_SECRET: z.string().optional(),
 	PAYPAL_API: z.string().url().optional(),
-	// Optional Redis — enables shared caching for rate limiting and site settings.
+	// Redis — strongly recommended in production (required for multi-instance).
+	// Without it, rate limits / shared caches are in-process only.
 	REDIS_URL: z.string().optional(),
 	// Logging level.
 	LOG_LEVEL: z.enum(["debug", "info", "warn", "error"]).optional(),
@@ -95,8 +96,8 @@ const schema = z.object({
 
 type Env = z.infer<typeof schema>;
 
-// SKIP_ENV_VALIDATION lets tooling (typecheck, tests that don't touch the DB)
-// import modules transitively without a populated .env.
+// SKIP_ENV_VALIDATION is for tooling only (vitest). Production deploy must NOT
+// set this — builds should validate AUTH_SECRET, DATABASE_URL, etc.
 export const env: Env = process.env.SKIP_ENV_VALIDATION
 	? (process.env as unknown as Env)
 	: schema.parse(process.env);