chore: harden deps, env validation, admin errors, and redis warnings

Align nodemailer with Auth.js peers, bump patch deps, validate env on deploy builds, add admin error boundary, and warn when Redis is missing in production.

Co-authored-by: Cursor <[email protected]>

src/lib/redis.ts

@@ -2,11 +2,25 @@ import "server-only";
 
 import Redis from "ioredis";
 
-const globalForRedis = globalThis as unknown as { redis?: Redis | null };
+const globalForRedis = globalThis as unknown as {
+	redis?: Redis | null;
+	redisMissingWarned?: boolean;
+};
 
 function createRedis(): Redis | null {
 	const url = process.env.REDIS_URL;
-	if (!url) return null;
+	if (!url) {
+		if (
+			process.env.NODE_ENV === "production" &&
+			!globalForRedis.redisMissingWarned
+		) {
+			globalForRedis.redisMissingWarned = true;
+			console.error(
+				"[redis] REDIS_URL is unset in production. Rate limits and shared caches fall back to in-process memory and will not work correctly across multiple instances.",
+			);
+		}
+		return null;
+	}
 	try {
 		const client = new Redis(url, {
 			maxRetriesPerRequest: 3,