Redis: shared rate limiting and hot-read cache for API and MCP

Context: API and MCP rate limiting is currently in-memory per pm2 process, so limits are roughly 2x intended and reset on every deploy. Public pages and hot queries hit Postgres directly.

Scope:

• Add a Redis client with graceful in-memory fallback when REDIS_URL is unset or unreachable.
• Move the REST rate limiter (src/lib/api/rest.ts) to Redis atomic INCR + TTL, shared across instances.
• Extend rate limiting to the MCP endpoint (tools/call) with a batch-size cap.
• Add a small cache helper for hot reads (status lists, project settings, public board payloads) with TTL + invalidation.

Infra: Redis LXC at 192.168.1.239:6379 (LAN). Requires a firewall allow from the prod VM 192.168.1.172 and REDIS_URL in /opt/hollahoop/.env. Rotate the Redis password before go-live.

Done when: limits are exact across both pm2 instances and survive a deploy; cache has TTL and invalidation; the app falls back cleanly when REDIS_URL is absent. Backs the broader abuse-hardening cards for API and MCP.