feat(admin): support authenticated Redis, and point at the external server

Adds REDIS_USERNAME and REDIS_PASSWORD. Both are optional, so an
unauthenticated instance still works unchanged. Redis 6+ ACL auth takes
both; a legacy requirepass instance takes the password with an empty
username, which is what go-redis needs to send single-argument AUTH.

Admin now defaults to the external Redis at 10.10.10.2:6379 rather than the
compose-local one, and no longer declares depends_on: redis -- it is not
starting that container any more. The base stack keeps its own Redis for
`server`, which still has no auth support.

Also fixes SMTP_PASSWORD in the admin block: it read `$SMTP_PASSWORD:-}`
rather than `${SMTP_PASSWORD:-}`, which appended a literal `:-}` to the
password and would have failed SMTP auth at the first verification email.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

admin/internal/auth/session.go

@@ -30,7 +30,18 @@ type Session struct {
 
 var rdb *redis.Client
 
-func InitRedis(addr string) { rdb = redis.NewClient(&redis.Options{Addr: addr}) }
+// InitRedis connects the session store.
+//
+// Username and password may both be empty for an unauthenticated instance. For
+// a legacy `requirepass` Redis, pass the password with an empty username —
+// go-redis then sends AUTH with one argument instead of two.
+func InitRedis(addr, username, password string) {
+	rdb = redis.NewClient(&redis.Options{
+		Addr:     addr,
+		Username: username,
+		Password: password,
+	})
+}
 
 func Ping(ctx context.Context) error { return rdb.Ping(ctx).Err() }
 

admin/internal/config/config.go

@@ -18,6 +18,8 @@ type Config struct {
 	ControlMongoURI string
 	ControlDBName   string
 	RedisAddr       string
+	RedisUsername   string
+	RedisPassword   string
 	SigningKey      string
 	PublicURL       string
 	AllowedOrigins  []string
@@ -54,6 +56,11 @@ func Load() (Config, error) {
 		AdminMongoURI:   os.Getenv("ADMIN_MONGO_URI"),
 		ControlMongoURI: os.Getenv("CONTROL_MONGO_URI"),
 		RedisAddr:       os.Getenv("REDIS_ADDR"),
+		// Optional: an unauthenticated Redis needs neither. Redis 6+ ACL auth
+		// takes both; a legacy `requirepass` instance takes the password alone
+		// and must leave the username empty.
+		RedisUsername: os.Getenv("REDIS_USERNAME"),
+		RedisPassword: os.Getenv("REDIS_PASSWORD"),
 		SigningKey:      os.Getenv("LICENSE_SIGNING_KEY"),
 		PublicURL:       strings.TrimSuffix(os.Getenv("PUBLIC_URL"), "/"),
 		TrustProxy:      strings.EqualFold(os.Getenv("TRUST_PROXY"), "true"),