deploy: require redis auth (--requirepass) across all consumers

Redis without a password was the root cause of the security incident
(cron miner via unauthenticated replication RCE, see
.forcc/deploy/SESSION2-FINDINGS.md). Loopback binding alone doesn't
protect against a compromised container inside the same compose
network, so wire REDIS_PASSWORD as a required secret everywhere redis
is used: backend/worker/worker-transcriber(-gpu), redis-exporter,
livekit and egress (via rendered templates). docker compose now
refuses to start without it instead of silently running unauthenticated.

deploy/egress/egress.yaml.template

@@ -13,9 +13,12 @@
 log_level: info
 
 # Обязателен для egress (координация запущенных записей, см. комментарий
-# в deploy/livekit/livekit.yaml).
+# в deploy/livekit/livekit.yaml). password подставляется рендером
+# (deploy/render-templates.sh) из REDIS_PASSWORD в .env — redis в
+# docker-compose.yml запускается с --requirepass.
 redis:
   address: redis:6379
+  password: ${REDIS_PASSWORD}
 
 # HTTP-эндпоинт /healthz для healthcheck контейнера.
 health_port: 8081