CM-1: Add Redis authentication to prevent unauthorized access

[szachovy]

Problem

Redis is deployed with zero authentication. Anyone with access to the Docker overlay network can read cached query results, inject Celery tasks, or flush all data.

File: services/superset/superset_config.py, src/container.py

Impact

• Data exfiltration (cached SQL query results accessible without authentication)
• Denial of service (FLUSHALL)
• Celery task injection → arbitrary code execution via deserialization attacks on the Celery worker

Fix

Generate a Redis password in crypto.py using os.urandom(24), pass as Docker secret, and configure requirepass. Also disable dangerous commands:

requirepass ${REDIS_PASSWORD}
rename-command FLUSHALL ""
rename-command FLUSHDB ""
rename-command CONFIG ""
rename-command DEBUG ""

Update all Redis URLs in superset_config.py to include the password.

Acceptance Criteria

• Redis password generated in crypto.py using os.urandom(24) encoded as base64
• redis.conf created with requirepass and dangerous commands renamed (FLUSHALL, FLUSHDB, CONFIG, DEBUG)
• Redis container mounts redis.conf with the generated password
• All Redis URLs in superset_config.py updated to include the password