fix: remove upstash dependency

[kevinrutledge]

Developer

Kevin Rutledge

What changed?

Production login returned 500 because the auth callback calls the Upstash rate limiter before its try block, so an unreachable Upstash threw. This removes the Upstash dependency entirely (rate limiting, idempotency, and the Redis email-quota pre-split), which ends that outage class for a low-traffic internal tool. Overflow past Brevo's daily cap still queues through Brevo's own QUOTA_EXCEEDED response.

• deletes src/lib/rate-limit.ts, src/lib/idempotency.ts, src/lib/email-quota.ts and their call sites
• src/env.ts, package.json drop the two env vars, the production requirement, and both @upstash packages

How to test

1. Point UPSTASH_REDIS_REST_URL at a dead host. On develop, POST /api/auth/callback returns 500. On this branch it returns 303.
2. npm test and npm run build pass.

Checklist

• Code works and is readable
• Tested locally
• Commits follow conventional commits
• Assigned reviewers