fix(api,web): env startup validation, QueryClient defaults, warn on missing REDIS_URL

- Throw at startup in production if REDIS_URL/DATABASE_URL/NEXTAUTH_SECRET missing
- Warn in development when REDIS_URL falls back to localhost
- QueryClient: add gcTime, disable refetchOnWindowFocus, skip retry on 4xx

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/src/instrumentation.ts

@@ -1,4 +1,11 @@
 export async function register() {
+  // Validate required env vars at startup — throws immediately in production
+  // if REDIS_URL, DATABASE_URL, or NEXTAUTH_SECRET are missing.
+  if (process.env.NEXT_RUNTIME === "nodejs") {
+    const { assertProductionEnv } = await import("@capakraken/api");
+    assertProductionEnv();
+  }
+
   // Only load Sentry in production — the worker.js crash in dev mode
   // (vendor-chunks/lib/worker.js MODULE_NOT_FOUND) makes the dev server unstable
   if (process.env.NODE_ENV === "production") {