feat(auth): Redis-backed OIDC sessions for portal + operator

nuxt-oidc-auth persists sessions via useStorage('oidc'), whose default
mount is per-pod memory — broken at >1 replica (random 401s) and every
deploy logged all users out. A nitro plugin now mounts 'oidc' on the
dezky-data Redis (db 1, app-prefixed keys, 14d TTL) when SESSION_REDIS_URL
is set; dev keeps the memory driver with no Redis required. Replicas back
to 2 for both apps.

infrastructure/production/fleet/apps/operator.yaml

@@ -13,11 +13,9 @@ metadata:
     app.kubernetes.io/name: operator
     app.kubernetes.io/part-of: dezky
 spec:
-  # Single replica until OIDC sessions move to shared storage: nuxt-oidc-auth
-  # keeps sessions in per-pod memory, so with >1 replica every request that
-  # lands on the pod that did NOT handle the login gets 401. TODO: nitro
-  # session storage on the dezky-data Redis, then scale back up.
-  replicas: 1
+  # Sessions live on the dezky-data Redis (server/plugins/session-storage.ts,
+  # SESSION_REDIS_URL from the app secret) — safe to run multiple replicas.
+  replicas: 2
   selector:
     matchLabels:
       app.kubernetes.io/name: operator