fix(resume): add ENCRYPTION_SECRET + redis so the AI tab loads

The v5 rewrite gates AI features behind two new env vars we never had.
Opening the AI Integrations tab calls aiProviders.list, which runs
assertCredentialEncryptionConfigured() and throws
AI_CREDENTIAL_ENCRYPTION_UNAVAILABLE when ENCRYPTION_SECRET is unset --
so the tab errored on mount instead of rendering.

The agent workspace has a second gate: isAgentEnvironmentConfigured()
requires ENCRYPTION_SECRET *and* REDIS_URL, so add a dedicated redis to
the stack rather than leaving the agent half-broken. Every other redis
on the host is on another stack's private network.

ENCRYPTION_SECRET encrypts stored provider API keys at rest (schema
requires >=32 chars); rotating it makes saved keys undecryptable, so
it is pinned like AUTH_SECRET.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

stacks/resume/docker-compose.yml

@@ -3,6 +3,7 @@
 # Volume -> bind-mount conversions (tiered per density policy):
 #   postgres data  -> /config/resume/postgres        (SSD; DB, low density)
 #   minio  data    -> /storage1/labdata/resume/minio (ZFS; object store, blobs)
+#   redis  data    -> /config/resume/redis           (SSD; AI agent stream state)
 #   app uploads    -> /storage1/labdata/resume/data  (ZFS; blobs, see app below)
 # The Chrome service is stateless. app + resume-minio join edge (resume.ginnoir.com,
 # storage.j-costa.com, minio.ginnoir.com); postgres stays private.
@@ -69,6 +70,22 @@ services:
       - EXIT_ON_HEALTH_FAILURE=true
       - PRE_REQUEST_HEALTH_CHECK=true
 
+  redis:
+    container_name: redis_resume
+    image: redis:7-alpine
+    restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
+    networks: [resume]
+    command: --save 60 1 --loglevel warning
+    volumes:
+      - /config/resume/redis:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
   app:
     container_name: resume
     image: amruthpillai/reactive-resume:latest
@@ -88,6 +105,8 @@ services:
         condition: service_healthy
       resume-minio:
         condition: service_healthy
+      redis:
+        condition: service_healthy
       chrome:
         condition: service_started
     env_file: