Misconfigured REDIS_URL (Upstash URL) crashes session creation with empty 500

Summary

If REDIS_URL/KV_URL is set to an Upstash REST URL (https://...) instead of a TCP connection string (rediss://...), every POST /api/sessions fails with a naked empty-body 500 and no useful client error. The Upstash console displays the REST endpoint, so this is an easy mistake for anyone wiring redis by hand instead of through the Vercel integration.

Error: Unsupported Redis URL protocol: https:
    at getRedisConnectionOptions (lib/redis.ts)

Issue

getSharedRedisClient() is called outside the try/catch in checkRateLimit (lib/rate-limit.ts), and the rate-limit check in app/api/sessions/route.ts runs before the route's own try block, so the throw escapes both and surfaces as a 500 with an empty body ("Unexpected end of JSON input" client-side). Nothing tells the user the redis URL format is wrong.

Suggestions

1. Validate the URL protocol where the env is read (e.g. REDIS_URL must be redis:// or rediss://, not https://. Use the TCP connection string instead)
2. Document redis requirements in the README:
   • the URL must be redis:///rediss:// (TCP), not the Upstash REST endpoint
   • in production, rate limiting requires redis and fails closed with 503 "Rate limit unavailable" when unset. The current line "optional skills metadata cache (falls back to in-memory when not configured)" reads misleading.

Repro

1. Set REDIS_URL=https://<anything>.upstash.io on a production deployment (or any env where it's read)
2. Sign in and create a session
3. POST /api/sessions → 500 with empty body; logs show Unsupported Redis URL protocol: https: