feat(queue): replace PocketBase polling with Asynq + Redis

Introduce a Redis-backed Asynq task queue so the runner consumes TTS
jobs pushed by the backend instead of polling PocketBase.

- backend/internal/asynqqueue: Producer and Consumer wrappers
- backend/internal/runner: AsynqRunner mux, per-instance Prometheus
  registry (fixes duplicate-collector panic in tests), redisConnOpt
- backend/internal/config: REDIS_ADDR / REDIS_PASSWORD env vars
- backend/cmd/{backend,runner}/main.go: wire Redis when env set; fall
  back to legacy poll mode when unset
- Caddyfile: caddy-l4 TCP proxy for redis.libnovel.cc:6380 → homelab
- caddy/Dockerfile: add --with github.com/mholt/caddy-l4
- docker-compose.yml: Caddy exposes 6380, backend/runner get Redis env
- homelab/runner/docker-compose.yml: Redis sidecar, runner depends_on
- homelab/otel/grafana: Grafana dashboards (backend, catalogue, runner)
  and alerting rules / contact-points provisioning

docker-compose.yml

@@ -163,6 +163,11 @@ services:
       GLITCHTIP_DSN: "${GLITCHTIP_DSN}"
       OTEL_EXPORTER_OTLP_ENDPOINT: "${OTEL_EXPORTER_OTLP_ENDPOINT}"
       OTEL_SERVICE_NAME: "backend"
+      # Asynq task queue — backend enqueues jobs to homelab Redis via Caddy TLS proxy.
+      # Set to "rediss://:password@redis.libnovel.cc:6380" in Doppler prd config.
+      # Leave empty to fall back to PocketBase polling.
+      REDIS_ADDR: "${REDIS_ADDR}"
+      REDIS_PASSWORD: "${REDIS_PASSWORD}"
     healthcheck:
       test: ["CMD", "/healthcheck", "http://localhost:8080/health"]
       interval: 15s
@@ -353,8 +358,9 @@ services:
 
 
   # ─── Caddy (reverse proxy + automatic HTTPS) ──────────────────────────────────
-  # Custom build includes github.com/mholt/caddy-ratelimit and
-  # github.com/hslatman/caddy-crowdsec-bouncer/http.
+  # Custom build includes github.com/mholt/caddy-ratelimit,
+  # github.com/hslatman/caddy-crowdsec-bouncer/http, and
+  # github.com/mholt/caddy-l4 (TCP layer4 proxy for Redis).
   caddy:
     image: kalekber/libnovel-caddy:${GIT_TAG:-latest}
     build:
@@ -372,9 +378,12 @@ services:
       - "80:80"
       - "443:443"
       - "443:443/udp" # HTTP/3 (QUIC)
+      - "6380:6380"   # Redis TCP proxy (TLS) for homelab → Asynq
     environment:
       DOMAIN: "${DOMAIN}"
       CADDY_ACME_EMAIL: "${CADDY_ACME_EMAIL}"
+      # Homelab Redis address — Caddy TCP-proxies inbound :6380 to this.
+      HOMELAB_REDIS_ADDR: "${HOMELAB_REDIS_ADDR:?HOMELAB_REDIS_ADDR required for Redis TCP proxy}"
     env_file:
       - path: ./crowdsec/.crowdsec.env
         required: false