fix: production deploy readiness — API boots on Vapron, web hits real API, test flake #4075

Originally written by @ccantynz-alt on GitHub.
Imported from https://github.com/ccantynz-alt/AlecRae.com/pull/56

Production-readiness bundle, surfaced by live testing of the deployed site.

1. API crashed on boot — now boots on Vapron (HIGH)

Vapron deploys one app per project from the repo root (no monorepo subdir support), and the API must listen on process.env.PORT. Two blockers:

• Boot crash: BullMQ forbids : in queue names, but queues were named alecrae:webhooks / alecrae:outbound / alecrae:dns-liveness, and the webhook worker was started unconditionally at startup → the process threw on boot. Renamed all queue names to hyphens repo-wide (api + mta + dns + fly.toml), keeping producer/consumer in sync.
• No root boot: added root start (bun run apps/api/src/index.ts) and build:api scripts. The Hono server already reads process.env.PORT and exports { port, fetch } for Bun.
• Graceful degradation: Redis-gated + fault-isolated the background startup (webhook worker, DLQ loop) so the API boots and serves /health with no Redis/Meilisearch configured.

✅ Verified locally: PORT=4999 bun run start → GET /health returns HTTP 200; webhook worker cleanly skips ("Redis not configured").

Vapron dashboard settings: Build Command bun run build:api (or empty — Bun needs no compile), Start Command bun run start, PORT injected by Vapron. Attach api.alecrae.com as the custom domain afterwards.

2. Production login broken — web client pointed at localhost (HIGH)

Live site: passkey showed "Can't reach the server"; Google sign-in redirected to http://localhost:3001/v1/auth/google (ERR_FAILED). Cause: web API_BASE fell back to localhost:3001 when NEXT_PUBLIC_API_URL was unset in the build. New apps/web/lib/api-base.ts → getApiBase(): env override → https://api.alecrae.com in the browser on a non-local host → localhost only for dev. All web API_BASE definitions routed through it. No hosting-provider env config required.

Depends on #1 being deployed: login works end-to-end once the API is live on Vapron and api.alecrae.com resolves to it.

3. Flaky encryption test (pre-existing)

RSA-4096 keygen per test (4-6s) tripped the 5s default on loaded CI runners (failed #55, unrelated to that change). Extended the 30s timeout to all keygen tests.

Verification

• API: bun run test 115/115 ✅, typecheck ✅, lint 0 errors, boots & serves /health ✅
• MTA + DNS services: typecheck ✅
• Web: typecheck ✅, build ✅
• docs:check ✅

https://claude.ai/code/session_01McgJLnTbZG9mwhfwd5iAX3