Fix paperless redis: use upstream valkey instead of amd64-only nix image

The authentik-redis image is nix-built on ringtail (amd64 only) and was
previously running under QEMU emulation on arm64 minikube. Discovered
during DR recovery when fresh minikube lacked binfmt registration.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

argocd/manifests/paperless/kustomization.yaml

@@ -14,8 +14,9 @@ resources:
 images:
   - name: registry.ops.eblu.me/blumeops/paperless
     newTag: v2.20.13-07f52e9
-  # TODO: borrowing authentik-redis image — consider building a generic
-  # blumeops/redis container if more services need Redis sidecars
+  # TODO(DR-2026-04): authentik-redis is amd64-only (nix-built on ringtail).
+  # Was running under QEMU emulation before. Switched to upstream valkey
+  # during DR recovery. Build a multi-arch blumeops/redis or keep upstream.
   - name: docker.io/library/redis
-    newName: registry.ops.eblu.me/blumeops/authentik-redis
-    newTag: v8.2.3-fd0bebb-nix
+    newName: docker.io/valkey/valkey
+    newTag: "8.1-alpine"