Mirror valkey 8.1 locally for paperless and immich (#346)

## Summary

- Add native Dagger build of valkey 8.1.6-r0 on Alpine 3.22 at `containers/valkey/`
- Swap paperless redis sidecar and immich-valkey from `docker.io/valkey/valkey:8.1-alpine` to `registry.ops.eblu.me/blumeops/valkey:v8.1.6-r0-946fa75`
- Resolves the DR-2026-04 TODO in paperless kustomization about multi-arch redis

## Why

Move toward fully locally-built containers for supply chain control. Paperless and immich both pulled the same upstream tag — one mirror serves both. Authentik's nix-built Redis stays separate (different image entirely).

## Risk

Low. Both sidecars are stateless caches:
- paperless redis: no volumeMount (in-pod localhost, pure memory)
- immich-valkey: `emptyDir` (cache only)

Pod restart rebuilds the cache. Smoke-tested locally (PING/SET/GET roundtrip on `valkey 8.1.6` with `--bind 0.0.0.0 --protected-mode no`).

## Test plan

- [ ] After merge: `mise run container-build-and-release valkey` to rebuild with main SHA
- [ ] Update kustomizations to the `[main]` SHA tag (C0 follow-up)
- [ ] `argocd app sync paperless` and `argocd app sync immich`
- [ ] Verify pods come up healthy (paperless OCR queue functional, immich job queue functional)
- [ ] `mise run services-check`

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #346

argocd/manifests/immich/kustomization.yaml

@@ -19,4 +19,5 @@ images:
   - name: ghcr.io/immich-app/immich-machine-learning
     newTag: v2.6.3
   - name: docker.io/valkey/valkey
-    newTag: "8.1-alpine"
+    newName: registry.ops.eblu.me/blumeops/valkey
+    newTag: v8.1.6-r0-946fa75

argocd/manifests/paperless/kustomization.yaml

@@ -14,9 +14,6 @@ resources:
 images:
   - name: registry.ops.eblu.me/blumeops/paperless
     newTag: v2.20.13-07f52e9
-  # TODO(DR-2026-04): authentik-redis is amd64-only (nix-built on ringtail).
-  # Was running under QEMU emulation before. Switched to upstream valkey
-  # during DR recovery. Build a multi-arch blumeops/redis or keep upstream.
   - name: docker.io/library/redis
-    newName: docker.io/valkey/valkey
-    newTag: "8.1-alpine"
+    newName: registry.ops.eblu.me/blumeops/valkey
+    newTag: v8.1.6-r0-946fa75