feat(queue): replace PocketBase polling with Asynq + Redis

Introduce a Redis-backed Asynq task queue so the runner consumes TTS
jobs pushed by the backend instead of polling PocketBase.

- backend/internal/asynqqueue: Producer and Consumer wrappers
- backend/internal/runner: AsynqRunner mux, per-instance Prometheus
  registry (fixes duplicate-collector panic in tests), redisConnOpt
- backend/internal/config: REDIS_ADDR / REDIS_PASSWORD env vars
- backend/cmd/{backend,runner}/main.go: wire Redis when env set; fall
  back to legacy poll mode when unset
- Caddyfile: caddy-l4 TCP proxy for redis.libnovel.cc:6380 → homelab
- caddy/Dockerfile: add --with github.com/mholt/caddy-l4
- docker-compose.yml: Caddy exposes 6380, backend/runner get Redis env
- homelab/runner/docker-compose.yml: Redis sidecar, runner depends_on
- homelab/otel/grafana: Grafana dashboards (backend, catalogue, runner)
  and alerting rules / contact-points provisioning

Caddyfile

@@ -234,3 +234,27 @@ search.libnovel.cc {
 	reverse_proxy meilisearch:7700
 }
 
+# ── Redis TCP proxy: exposes homelab Redis over TLS for Asynq ─────────────────
+# The backend (prod) connects to rediss://redis.libnovel.cc:6380 to enqueue
+# Asynq jobs. Caddy terminates TLS (Let's Encrypt cert for redis.libnovel.cc)
+# and proxies the raw TCP stream to the homelab Redis via this reverse proxy.
+#
+# NOTE: Redis is NOT running on the prod server — it runs on the homelab
+# (192.168.0.109:6379) and is exposed to the internet via this Caddy proxy.
+# The homelab Redis is protected by REDIS_PASSWORD (requirepass).
+#
+# Caddy layer4 app handles this; requires the caddy-l4 module in the build.
+{
+	layer4 {
+		redis.libnovel.cc:6380 {
+			route {
+				tls
+				proxy {
+					# Homelab Redis — replace with actual homelab IP or FQDN
+					upstream {$HOMELAB_REDIS_ADDR:192.168.0.109:6379}
+				}
+			}
+		}
+	}
+}
+}