Deploy Redis, backing toolshed's managed cache add-on

Registers the new hand-written redis chart (devops-infra-helm-charts,
separate commit) and the ExternalSecret feeding its admin password from
Vault. Own namespace, addressed over cluster DNS like every other platform
component here:

  redis.redis.svc.cluster.local:6379

Only one consumer for the credential, unlike the Postgres one next door:
the server itself, to seed its ACL file on first boot. toolshed's api gets
it from the connection an operator configures in the dashboard, encrypted
in toolshed's own database — so there is deliberately no second
ExternalSecret into the toolshed namespace.

Order matters: put the password in Vault at secret/toolshed/redis before
syncing, or the init container sits in CreateContainerConfigError. The
exact command, the reason the password must be alphanumeric (it is written
into an ACL directive where a space or quote would split it), and the
manual rotation procedure are all recorded in the ExternalSecret's own
header.

Nothing here needs to change for Postgres: toolshed's managed database
add-on points at the existing postgresql.postgres.svc.cluster.local, whose
POSTGRES_USER is the initdb superuser and so already has the CREATEDB and
CREATEROLE that provisioning needs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wajog7nELA3i8JWTjxYGHF

values/incubator-infra-k8s-admin-prd-ase1-values.yaml

@@ -132,6 +132,27 @@ appSpec:
     namespace: postgres
     chartDir: postgresql
     valuesDir: postgresql
+  - name: redis
+    # Backs toolshed's managed cache add-on — toolshed provisions a per-app
+    # ACL user, scoped to its own key prefix, on request. Own namespace for
+    # the same reason postgresql has one: addressed over cluster DNS like
+    # any other platform component, outliving whatever consumes it:
+    #   redis.redis.svc.cluster.local:6379
+    #
+    # Hand-written chart, not Bitnami's, for the same reason as postgresql
+    # (infra issue #4) — Redis ships no official chart either.
+    #
+    # Authentication is defined by an ACL file with no requirepass, which
+    # is a security property rather than a preference: see the chart's own
+    # values.yaml, where getting it wrong leaves the server open to
+    # unauthenticated access after its first restart.
+    #
+    # Requires secretstores/toolshed-redis-credentials.yaml to have synced
+    # first — the init container cannot seed the ACL file without it.
+    nameOverride: redis
+    namespace: redis
+    chartDir: redis
+    valuesDir: redis
   - name: victoria-metrics-single
     # Replaces the Prometheus server this entry briefly was (see git
     # history on this file) — same job, lower RAM/disk footprint for the