feat(admin): support authenticated Redis, and point at the external server

Adds REDIS_USERNAME and REDIS_PASSWORD. Both are optional, so an
unauthenticated instance still works unchanged. Redis 6+ ACL auth takes
both; a legacy requirepass instance takes the password with an empty
username, which is what go-redis needs to send single-argument AUTH.

Admin now defaults to the external Redis at 10.10.10.2:6379 rather than the
compose-local one, and no longer declares depends_on: redis -- it is not
starting that container any more. The base stack keeps its own Redis for
`server`, which still has no auth support.

Also fixes SMTP_PASSWORD in the admin block: it read `$SMTP_PASSWORD:-}`
rather than `${SMTP_PASSWORD:-}`, which appended a literal `:-}` to the
password and would have failed SMTP auth at the first verification email.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

admin/cmd/main.go

@@ -40,7 +40,7 @@ func main() {
 		log.Println("warning: SMTP not configured; verification and licence emails will fail")
 	}
 
-	auth.InitRedis(cfg.RedisAddr)
+	auth.InitRedis(cfg.RedisAddr, cfg.RedisUsername, cfg.RedisPassword)
 	pingCtx, pingCancel := context.WithTimeout(context.Background(), 10*time.Second)
 	if err := auth.Ping(pingCtx); err != nil {
 		pingCancel()