feat(auth): Redis-backed OIDC sessions for portal + operator

nuxt-oidc-auth persists sessions via useStorage('oidc'), whose default
mount is per-pod memory — broken at >1 replica (random 401s) and every
deploy logged all users out. A nitro plugin now mounts 'oidc' on the
dezky-data Redis (db 1, app-prefixed keys, 14d TTL) when SESSION_REDIS_URL
is set; dev keeps the memory driver with no Redis required. Replicas back
to 2 for both apps.

infrastructure/production/fleet/apps/secrets.example.yaml

@@ -71,6 +71,11 @@ stringData:
   # die on every pod restart (random keys are generated per boot).
   NUXT_OIDC_TOKEN_KEY: "data:;base64,REPLACE_WITH_openssl_rand_base64_32"
   NUXT_OIDC_AUTH_SESSION_SECRET: "REPLACE_WITH_openssl_rand_hex_24"
+  # Shared session storage (server/plugins/session-storage.ts) — required for
+  # >1 replica and for sessions to survive deploys. Password = dezky-data
+  # redis-secret.REDIS_PASSWORD; db 1 keeps app sessions out of Authentik's
+  # keyspace.
+  SESSION_REDIS_URL: "redis://:REDIS_PASSWORD@redis.dezky-data.svc.cluster.local:6379/1"
 ---
 apiVersion: v1
 kind: Secret
@@ -112,3 +117,5 @@ stringData:
   NUXT_OIDC_PROVIDERS_OIDC_OPEN_ID_CONFIGURATION: "https://auth.dezky.eu/application/o/dezky-operator/.well-known/openid-configuration"
   NUXT_OIDC_TOKEN_KEY: "data:;base64,REPLACE_WITH_openssl_rand_base64_32"
   NUXT_OIDC_AUTH_SESSION_SECRET: "REPLACE_WITH_openssl_rand_hex_24"
+  # Shared session storage — see the portal section above.
+  SESSION_REDIS_URL: "redis://:REDIS_PASSWORD@redis.dezky-data.svc.cluster.local:6379/1"