Integrate Upstash Redis for rate limiting (deferred to Phase 8+)

## Summary

Rate limiting via Upstash Redis is planned but deferred to Phase 8 (Production Testing) or later. Currently, auth endpoints fail open (no enforcement).

## Status

- [x] Rate limiting code scaffolding in place (`src/lib/ratelimit.ts`)
- [x] Graceful degradation (works without Upstash keys)
- [ ] Upstash integration (deferred)
- [ ] Production enforcement on auth endpoints

## Next Steps

When ready for production hardening:
1. Create Upstash Redis database (free tier: 10k commands/day)
2. Add `UPSTASH_REDIS_REST_URL` and `UPSTASH_REDIS_REST_TOKEN` to production env
3. Rate limiting will activate automatically with no code changes

## Why Deferred?

- Auth endpoints work fine without rate limiting for local dev + early testing
- Adds external dependency (Upstash account + keys)
- Can be added at any time without code changes (fail-open design)
- Better to focus on core auth flows first

## Related

- Business Template: Magic Link Auth Flow (Phase 1) ✅
- Rate limiting already integrated but optional