Upstash read-only token blocks writes, and also blocks SCAN and KEYS

# Upstash read-only token -  writes fail, and so do SCAN and KEYS

## What you see

Write commands (SET, DEL, INCR, ...) return permission errors when
authenticated with the read-only token. SCAN and KEYS also fail, which
surprises people because they are reads.

## Why

The read-only token is meant for untrusted environments (browsers,
phones). SCAN and KEYS can enumerate the whole keyspace, so they are
blocked to keep a leaked read-only token from becoming a data
exfiltration tool.

## Confirm

Run the same command with the standard token. If it succeeds, the
token scope is the issue, not the command.

## Fix

- Writes from client code: move them server side behind your API,
  which holds the standard token.
- Key enumeration: redesign so clients always know exact keys. Use
  known key patterns (user:42:cart) instead of scanning.
- If you genuinely need SCAN from a client, you are holding the wrong
  token -  that operation belongs server side.

## Verify

Reads with the read-only token succeed, writes fail closed, and no
client code path depends on SCAN or KEYS.