security: Convert Redis NetworkPolicy from same-namespace to zero-trust

- Replace fromSameNamespace: true with specific allowedCallers
- Only allow pdf-processor-service, pdf-extraction-service, metadata-service, cleaner
- Implements zero-trust security pattern consistent with other services
- Prevents unauthorized Redis access from any service in namespace
- Matches service communication matrix in README

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: NotYuSheng

helm/redis/values.yaml

@@ -171,8 +171,25 @@ networkPolicy:
   enabled: false
   ingress:
     enabled: true
-    fromSameNamespace: true
-    fromIngressController: false
+    # ZERO-TRUST: Only specific services can connect to Redis
+    allowedCallers:
+      # PDF processor orchestrates workflows and manages sessions
+      - podSelector:
+          matchLabels:
+            app.kubernetes.io/name: pdf-processor-service
+      # PDF extraction manages document file lists
+      - podSelector:
+          matchLabels:
+            app.kubernetes.io/name: pdf-extraction-service
+      # Metadata service manages document file lists
+      - podSelector:
+          matchLabels:
+            app.kubernetes.io/name: metadata-service
+      # Cleaner accesses Redis for cleanup notifications
+      - podSelector:
+          matchLabels:
+            app.kubernetes.io/name: cleaner
+    # Custom ingress rules for special cases
     customRules: []
   egress:
     enabled: false