WOR-1946 Preserve Redis L2 TLS, AUTH, and database semantics

[rickcrawford]

Summary

• Preserve complete validated redis:// and rediss:// connection semantics across the general L2 store, AI compression state, and admin paths: ACL authentication, percent-encoded credentials, IPv6, selected databases, private CAs, and mutual TLS.
• Compile one immutable Redis connection snapshot per configuration generation and reuse it at runtime, avoiding TLS file rereads while retaining lazy bounded pooling, reconnect behavior, and fail-open compression semantics.
• Replace the blocking plaintext RESP path with redis-rs, add privacy-safe bounded logging and metrics, and classify connection, TLS, authentication, and command failures without leaking endpoints or credentials.
• Add secure operator documentation, a runnable TLS/mTLS/AUTH/DB example, generated schema and AI-readable docs, and deterministic plus live integration coverage for every blocking command family.

Linear: https://linear.app/soapbucket/issue/WOR-1946/redis-general-l2-client-must-preserve-tls-auth-and-database-dsn

Verification

• cargo fmt --all -- --check
• cargo build --workspace --locked
• cargo nextest run --workspace --exclude sbproxy-e2e --locked --profile ci: 7,031 passed, 56 configured skips
• cargo clippy --workspace --all-targets --locked -- -D warnings
• Workspace doctests: 15 passed, 9 ignored
• Rustdoc with warnings denied
• Secure live Redis suite: 12 passed, covering ACL fallback prevention, database selection, TLS downgrade detection, private CA, mTLS, TTL, atomic increment, token-owned unlock fencing, and prefix scan
• Admin fixture stress regression: 100/100 iterations passed
• Config schema, metrics stability, AI-readable docs, cargo-deny, NOTICE coverage, diff hygiene, and changed-line typography checks passed