Launch hardening: action rate-limiting, prod email fail-closed, CI e2e job, DR docs, dead-code sweep

Audit leftovers mapped to #35/#39/#42:

1. Server actions unlimited — only BetterAuth endpoints rate-limited today; checkout/refunds/redeem/import are open abuse surface. Upstash store already exists.
   • sliding-window helper + safe-action middleware; caps: checkout 10/min/user, refunds 5/hr, redeem/import 20/hr/org
   • Idempotency-Key check in createCheckout (table exists)
2. Prod email fails open — console fallback when RESEND_API_KEY missing → silent signup breakage; @react-email installed but unused.
   • throw+Sentry in production; port verification/reset/receipt to react-email templates
3. Playwright not in CI — add e2e job (Postgres service container, migrate+seed+run) w/ golden-path spec: signup→verify→buy→complete→quiz→certificate verify
4. Backups/PITR undocumented — DEPLOYMENT.md DR section (Supabase PITR window, monthly restore drill, RPO/RTO)
5. Dead exports sweep after #57 lands (getLiveSessionEmbedData, getFermionLoginLink, requestDsaRun/getDsaRunResult, storage helpers)

Spec: temp prompt library 09-launch-hardening.

Treat this as a multi-part launch-hardening effort and split the work across the five numbered areas. Start with the existing Upstash store, createCheckout, safe-action middleware, the Playwright setup, and DEPLOYMENT.md; verify the golden-path e2e flow and the listed rate limits, email behavior, DR guidance, and dead-export sweep after #57. Done means every checklist item is addressed and the CI job runs the seeded Postgres flow.