fix(api,web): env startup validation, QueryClient defaults, warn on missing REDIS_URL

- Throw at startup in production if REDIS_URL/DATABASE_URL/NEXTAUTH_SECRET missing
- Warn in development when REDIS_URL falls back to localhost
- QueryClient: add gcTime, disable refetchOnWindowFocus, skip retry on 4xx

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/api/src/lib/env.ts

@@ -0,0 +1,15 @@
+/**
+ * Startup environment validation.
+ * Call assertProductionEnv() early in the server lifecycle to surface missing
+ * critical configuration before any requests are served.
+ */
+export function assertProductionEnv(): void {
+  if (process.env["NODE_ENV"] !== "production") return;
+
+  const required = ["REDIS_URL", "DATABASE_URL", "NEXTAUTH_SECRET"] as const;
+  const missing = required.filter((k) => !process.env[k]);
+
+  if (missing.length > 0) {
+    throw new Error(`Missing required env vars: ${missing.join(", ")}`);
+  }
+}