chore: harden deps, env validation, admin errors, and redis warnings

Align nodemailer with Auth.js peers, bump patch deps, validate env on deploy builds, add admin error boundary, and warn when Redis is missing in production.

Co-authored-by: Cursor <[email protected]>

src/lib/rate-limit.ts

@@ -13,6 +13,7 @@ const CLEANUP_INTERVAL_MS = 300_000;
 const MAX_BUCKETS = 10_000;
 
 let lastCleanup = Date.now();
+let redisFailWarned = false;
 
 function cleanup(): void {
 	const now = Date.now();
@@ -54,6 +55,12 @@ export async function rateLimit(
 			return { ok: true, retryAfter: 0 };
 		} catch {
 			// Redis unavailable — fall through to in-memory
+			if (process.env.NODE_ENV === "production" && !redisFailWarned) {
+				redisFailWarned = true;
+				console.error(
+					"[rate-limit] Redis error — falling back to in-process buckets. Limits are not shared across instances until Redis recovers.",
+				);
+			}
 		}
 	}