feat(api): add SSE subscriber isolation, token pruning and E2E rate-limit guard

- event-bus: wrap each subscriber.fn call in try/catch so one throwing subscriber cannot kill delivery to all others
- event-bus: log Redis parse errors instead of swallowing them silently; add .catch() on Redis publish promise for async fallback to local delivery
- pruning.ts: new runPruning() deletes expired invite tokens, expired password-reset tokens, and read notifications older than 90 days
- settings.runPruning: expose pruning as adminProcedure mutation
- trpc.ts: E2E_TEST_MODE rate-limit bypass is now a no-op in production (NODE_ENV=production); logs a startup warning if misconfigured

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/api/src/trpc.ts

@@ -89,7 +89,12 @@ export const publicProcedure = t.procedure;
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 const withLogging = t.middleware(loggingMiddleware as any);
-const isE2eTestMode = process.env["E2E_TEST_MODE"] === "true";
+const isE2eTestMode =
+  process.env["E2E_TEST_MODE"] === "true" && process.env["NODE_ENV"] !== "production";
+if (process.env["E2E_TEST_MODE"] === "true" && process.env["NODE_ENV"] === "production") {
+  // eslint-disable-next-line no-console
+  console.warn("[SECURITY] E2E_TEST_MODE is set in production — rate limiting is NOT bypassed.");
+}
 
 /**
  * Protected procedure — requires authenticated session AND a valid DB user record.