feat(be): connect to redis over tls when REDIS_TLS is true

Summary

B1 from the infra plan: let be/ reach Redis over TLS, which prod ElastiCache requires (transit_encryption_enabled + AUTH token in infra/modules/app-stack/elasticache.tf).

• New env REDIS_TLS. true adds tls: {} to the cache client (RedisModule in app.module.ts) and the BullMQ connection (bull.config.ts). Those are the only two production Redis connections.
• Unset or anything other than true keeps plain TCP, so local, CI and staging (LocalStack Redis has no TLS) are unchanged.

Verification

• redis.config.spec.ts: switch on/off for both configs; mutation-checked.
• Live check against a local redis:7 with TLS-only + requirepass: with REDIS_TLS=true the cache client PINGs and BullMQ adds a job; without it both fail with "Connection is closed".
• tsc/eslint clean on touched files.
• Codex adversarial review: 2 rounds. Round 1 flagged the opt-in *.postgres.spec.ts suites' direct ioredis clients; rebutted (local-only tests, never pointed at ElastiCache) and accepted in round 2.

Deploy note

Prod app-env secret must set REDIS_TLS=true and REDIS_PASSWORD = the ElastiCache AUTH token. Staging needs nothing.

🤖 Generated with Claude Code