fix(sync): 修复自托管下无法读取 Upstash 配置

app/api/user/{sync,config} 用 @upstash/redis/cloudflare 的
Redis.fromEnv() 创建客户端。该实现只读传入的 env 参数或 Cloudflare
全局绑定，从不回退到 process.env，因此在 Docker / Node 自托管下
url 与 token 恒为 undefined，两个接口必定返回 500，跨设备同步
（收藏、历史、设置）完全不可用。认证走的是 auth.ts 里的
new Redis({ url, token })，所以登录正常，只有用户数据读写失败。

把 auth.ts 中已有的双源回退抽成 lib/server/runtime-env.ts，Redis
客户端抽成 lib/server/redis.ts，两个路由改为惰性获取共享客户端。
惰性创建同时修正了另一个隐患：Cloudflare 的 per-request 绑定在
模块求值阶段不可达，而原先客户端是在模块作用域创建的。

未配置 Upstash 时返回 503 并给出明确说明，而不是当成请求失败。

Fixes #226

lib/server/auth.ts

@@ -1,6 +1,6 @@
-import { Redis } from '@upstash/redis/cloudflare';
-import { getOptionalRequestContext } from '@cloudflare/next-on-pages';
 import { NextRequest, NextResponse } from 'next/server';
+import { getRedisClient } from '@/lib/server/redis';
+import { getRuntimeEnvValue } from '@/lib/server/runtime-env';
 import { getRuntimeFeatures } from '@/lib/server/runtime-features';
 import {
   createStoredAccount,
@@ -87,25 +87,11 @@ const DANMAKU_API_URL = process.env.DANMAKU_API_URL || process.env.NEXT_PUBLIC_D
 const SESSION_MAX_AGE_SECONDS = 60 * 60 * 24 * 30;
 const MANAGED_AUTH_FORCED = process.env.MANAGED_AUTH_ENABLED === 'true';
 
-function getRuntimeEnvValue(name: string, fallback = ''): string {
-  try {
-    const runtimeEnv = getOptionalRequestContext()?.env as unknown as Record<string, unknown> | undefined;
-    const value = runtimeEnv?.[name];
-    if (typeof value === 'string') return value;
-  } catch {
-    // Outside Cloudflare's request runtime, fall back to process.env.
-  }
-
-  return process.env[name] || fallback;
-}
-
 function getEffectiveAdminPassword(): string {
   return getRuntimeEnvValue('ADMIN_PASSWORD', ADMIN_PASSWORD) ||
     getRuntimeEnvValue('ACCESS_PASSWORD', ACCESS_PASSWORD);
 }
 
-let cachedRedis: Redis | null | undefined;
-
 export class ManagedAuthStorageError extends Error {
   constructor(operation: 'read' | 'write', cause?: unknown) {
     super(`Managed auth storage ${operation} failed`, { cause });
@@ -113,25 +99,6 @@ export class ManagedAuthStorageError extends Error {
   }
 }
 
-function getRedisClient(): Redis | null {
-  if (cachedRedis !== undefined) {
-    return cachedRedis;
-  }
-
-  const url = getRuntimeEnvValue('UPSTASH_REDIS_REST_URL');
-  const token = getRuntimeEnvValue('UPSTASH_REDIS_REST_TOKEN');
-  if (!url || !token) {
-    cachedRedis = null;
-    return cachedRedis;
-  }
-
-  cachedRedis = new Redis({
-    url,
-    token,
-  });
-  return cachedRedis;
-}
-
 function isManagedAuthEnabled(): boolean {
   return !!getRuntimeEnvValue('AUTH_SECRET', AUTH_SECRET) && !!getRedisClient();
 }

lib/server/redis.ts

@@ -0,0 +1,36 @@
+import { Redis } from '@upstash/redis/cloudflare';
+
+import { getRuntimeEnvValue } from '@/lib/server/runtime-env';
+
+let cachedRedis: Redis | null | undefined;
+
+/**
+ * Build the shared Upstash client from whichever environment source is available.
+ *
+ * `Redis.fromEnv()` is deliberately not used here: the `@upstash/redis/cloudflare`
+ * implementation only reads Cloudflare's global bindings and never falls back to
+ * `process.env`, so it always resolves to `undefined` on Docker / Node
+ * self-hosted deployments. The client is also created lazily because Cloudflare's
+ * per-request bindings are not reachable while a module is being evaluated.
+ *
+ * Returns `null` when Upstash is not configured, which callers should treat as
+ * "server-side sync unavailable" rather than as a request failure.
+ */
+export function getRedisClient(): Redis | null {
+  if (cachedRedis !== undefined) {
+    return cachedRedis;
+  }
+
+  const url = getRuntimeEnvValue('UPSTASH_REDIS_REST_URL');
+  const token = getRuntimeEnvValue('UPSTASH_REDIS_REST_TOKEN');
+  if (!url || !token) {
+    cachedRedis = null;
+    return cachedRedis;
+  }
+
+  cachedRedis = new Redis({
+    url,
+    token,
+  });
+  return cachedRedis;
+}

lib/server/runtime-env.ts

@@ -0,0 +1,20 @@
+import { getOptionalRequestContext } from '@cloudflare/next-on-pages';
+
+/**
+ * Read an environment value that may live in either runtime environment.
+ *
+ * On Cloudflare, bindings and secrets are only reachable through the
+ * per-request context. On Docker / Node self-hosting there is no such context,
+ * so the value comes from `process.env`.
+ */
+export function getRuntimeEnvValue(name: string, fallback = ''): string {
+  try {
+    const runtimeEnv = getOptionalRequestContext()?.env as unknown as Record<string, unknown> | undefined;
+    const value = runtimeEnv?.[name];
+    if (typeof value === 'string') return value;
+  } catch {
+    // Outside Cloudflare's request runtime, fall back to process.env.
+  }
+
+  return process.env[name] || fallback;
+}