fix: Embedded luxury self-contained CSS (zero CDN failure) + Redis password graceful auth

backend/app/Core/RedisClient.php

@@ -4,7 +4,7 @@ namespace App\Core;
 
 /**
  * Core Redis Client for managing connections.
- * Strict environment variable enforcement (No default fallbacks).
+ * Handles Sessions, Rate Limiting, OTP, and Caching.
  */
 class RedisClient
 {
@@ -18,7 +18,7 @@ class RedisClient
         if (self::$instance === null) {
             $host     = getenv('REDIS_HOST');
             $port     = getenv('REDIS_PORT');
-            $password = getenv('REDIS_PASSWORD') ?: null;
+            $password = getenv('REDIS_PASSWORD');
 
             $missing = [];
             if ($host === false || $host === '') $missing[] = 'REDIS_HOST';
@@ -36,10 +36,19 @@ class RedisClient
                     throw new \RuntimeException("Could not connect to Redis server at {$host}:{$port}");
                 }
 
-                // Authenticate if password is provided
-                if ($password) {
-                    if (!$redis->auth($password)) {
-                        throw new \RuntimeException("Redis authentication failed for host {$host}:{$port}.");
+                // Authenticate ONLY if a non-empty password is provided in environment
+                if (!empty($password)) {
+                    try {
+                        if (!$redis->auth($password)) {
+                            throw new \RuntimeException("Redis authentication failed with provided REDIS_PASSWORD.");
+                        }
+                    } catch (\RedisException $authEx) {
+                        // If server does not have a password configured, catch and report clearly
+                        if (str_contains($authEx->getMessage(), 'no password is set') || str_contains($authEx->getMessage(), 'without any password')) {
+                            error_log("⚠️ [Redis Notice] REDIS_PASSWORD was provided in .env, but Redis server on {$host}:{$port} is configured without password.");
+                        } else {
+                            throw $authEx;
+                        }
                     }
                 }