fix(api,web): env startup validation, QueryClient defaults, warn on missing REDIS_URL

- Throw at startup in production if REDIS_URL/DATABASE_URL/NEXTAUTH_SECRET missing
- Warn in development when REDIS_URL falls back to localhost
- QueryClient: add gcTime, disable refetchOnWindowFocus, skip retry on 4xx

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/api/src/index.ts

@@ -13,3 +13,4 @@ export { lookupRate, type RateCardLookupParams, type RateCardLookupResult } from
 export { autoImportPublicHolidays, type AutoImportResult } from "./lib/holiday-auto-import.js";
 export { createAuditEntry, computeDiff, generateSummary } from "./lib/audit.js";
 export { loggedAiCall } from "./ai-client.js";
+export { assertProductionEnv } from "./lib/env.js";