fix(api,web): env startup validation, QueryClient defaults, warn on missing REDIS_URL

- Throw at startup in production if REDIS_URL/DATABASE_URL/NEXTAUTH_SECRET missing
- Warn in development when REDIS_URL falls back to localhost
- QueryClient: add gcTime, disable refetchOnWindowFocus, skip retry on 4xx

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/api/src/lib/cache.ts

@@ -1,7 +1,11 @@
 import { Redis } from "ioredis";
 import { logger } from "./logger.js";
 
-const REDIS_URL = process.env["REDIS_URL"] ?? "redis://localhost:6380";
+const REDIS_URL = process.env["REDIS_URL"] ?? (
+  process.env["NODE_ENV"] !== "production"
+    ? (console.warn("[env] REDIS_URL not set, using localhost fallback"), "redis://localhost:6380")
+    : (() => { throw new Error("REDIS_URL required in production"); })()
+);
 const KEY_PREFIX = "dashboard:";
 const DEFAULT_TTL_SECONDS = 60;