feat(auth): Redis-backed OIDC sessions for portal + operator

nuxt-oidc-auth persists sessions via useStorage('oidc'), whose default
mount is per-pod memory — broken at >1 replica (random 401s) and every
deploy logged all users out. A nitro plugin now mounts 'oidc' on the
dezky-data Redis (db 1, app-prefixed keys, 14d TTL) when SESSION_REDIS_URL
is set; dev keeps the memory driver with no Redis required. Replicas back
to 2 for both apps.

infrastructure/production/fleet/apps/operator.yaml

@@ -13,11 +13,9 @@ metadata:
     app.kubernetes.io/name: operator
     app.kubernetes.io/part-of: dezky
 spec:
-  # Single replica until OIDC sessions move to shared storage: nuxt-oidc-auth
-  # keeps sessions in per-pod memory, so with >1 replica every request that
-  # lands on the pod that did NOT handle the login gets 401. TODO: nitro
-  # session storage on the dezky-data Redis, then scale back up.
-  replicas: 1
+  # Sessions live on the dezky-data Redis (server/plugins/session-storage.ts,
+  # SESSION_REDIS_URL from the app secret) — safe to run multiple replicas.
+  replicas: 2
   selector:
     matchLabels:
       app.kubernetes.io/name: operator

infrastructure/production/fleet/apps/portal.yaml

@@ -10,11 +10,9 @@ metadata:
     app.kubernetes.io/name: portal
     app.kubernetes.io/part-of: dezky
 spec:
-  # Single replica until OIDC sessions move to shared storage: nuxt-oidc-auth
-  # keeps sessions in per-pod memory, so with >1 replica every request that
-  # lands on the pod that did NOT handle the login gets 401. TODO: nitro
-  # session storage on the dezky-data Redis, then scale back up.
-  replicas: 1
+  # Sessions live on the dezky-data Redis (server/plugins/session-storage.ts,
+  # SESSION_REDIS_URL from the app secret) — safe to run multiple replicas.
+  replicas: 2
   selector:
     matchLabels:
       app.kubernetes.io/name: portal

infrastructure/production/fleet/apps/secrets.example.yaml

@@ -71,6 +71,11 @@ stringData:
   # die on every pod restart (random keys are generated per boot).
   NUXT_OIDC_TOKEN_KEY: "data:;base64,REPLACE_WITH_openssl_rand_base64_32"
   NUXT_OIDC_AUTH_SESSION_SECRET: "REPLACE_WITH_openssl_rand_hex_24"
+  # Shared session storage (server/plugins/session-storage.ts) — required for
+  # >1 replica and for sessions to survive deploys. Password = dezky-data
+  # redis-secret.REDIS_PASSWORD; db 1 keeps app sessions out of Authentik's
+  # keyspace.
+  SESSION_REDIS_URL: "redis://:REDIS_PASSWORD@redis.dezky-data.svc.cluster.local:6379/1"
 ---
 apiVersion: v1
 kind: Secret
@@ -112,3 +117,5 @@ stringData:
   NUXT_OIDC_PROVIDERS_OIDC_OPEN_ID_CONFIGURATION: "https://auth.dezky.eu/application/o/dezky-operator/.well-known/openid-configuration"
   NUXT_OIDC_TOKEN_KEY: "data:;base64,REPLACE_WITH_openssl_rand_base64_32"
   NUXT_OIDC_AUTH_SESSION_SECRET: "REPLACE_WITH_openssl_rand_hex_24"
+  # Shared session storage — see the portal section above.
+  SESSION_REDIS_URL: "redis://:REDIS_PASSWORD@redis.dezky-data.svc.cluster.local:6379/1"