fix(redis): stop putting the admin password on the exec command line

REDIS_EXEC_SHELL passed -e REDIS_PASSWORD=<value>, which puts the secret
into every rendered command and into the process list inside the
container. The container already carries REDIS_PASSWORD from its own env
file, sourced from the same credential, so the flag added exposure and
nothing else; an authenticated redis-cli ping from inside proves it.

REDIS_ACL_PASSWORD keeps its explicit -e: it is a per-consumer secret the
container does not hold.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/svc-db-redis/tasks/01_init.yml

@@ -47,7 +47,6 @@
 - name: "🔧 REDIS | Provision ACL user {{ redis_acl_username }} (auth-isolated)"
   ansible.builtin.shell: >
     container exec
-    -e REDIS_PASSWORD={{ REDIS_PASSWORD | quote }}
     -e REDIS_ACL_PASSWORD={{ redis_acl_password | quote }}
     {{ REDIS_CONTAINER_ADDRESS }} sh -lc
     '{{ REDIS_CLI }} ACL SETUSER {{ redis_acl_username }}

roles/svc-db-redis/vars/main.yml

@@ -10,5 +10,5 @@ REDIS_PASSWORD: "{{ lookup('config', application_id, 'credentials.REDIS_PASSWORD
 REDIS_EXPOSE_LOCAL: true
 REDIS_RETRIES: 5
 REDIS_DELAY: 5
-REDIS_EXEC_SHELL: "container exec -e REDIS_PASSWORD={{ REDIS_PASSWORD | quote }} {{ REDIS_CONTAINER_ADDRESS }} sh -lc"
+REDIS_EXEC_SHELL: "container exec {{ REDIS_CONTAINER_ADDRESS }} sh -lc"
 REDIS_CLI: 'redis-cli -a "$REDIS_PASSWORD" --no-auth-warning'