fix(api,web): env startup validation, QueryClient defaults, warn on missing REDIS_URL

- Throw at startup in production if REDIS_URL/DATABASE_URL/NEXTAUTH_SECRET missing
- Warn in development when REDIS_URL falls back to localhost
- QueryClient: add gcTime, disable refetchOnWindowFocus, skip retry on 4xx

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/api/src/sse/event-bus.ts

@@ -180,7 +180,11 @@ export function cancelPendingEvents(): void {
 }
 
 // Redis connection — use env var REDIS_URL or fallback to default dev URL
-const REDIS_URL = process.env["REDIS_URL"] ?? "redis://localhost:6380";
+const REDIS_URL = process.env["REDIS_URL"] ?? (
+  process.env["NODE_ENV"] !== "production"
+    ? (console.warn("[env] REDIS_URL not set, using localhost fallback"), "redis://localhost:6380")
+    : (() => { throw new Error("REDIS_URL required in production"); })()
+);
 const CHANNEL = "capakraken:sse";
 
 let publisher: Redis | null = null;