Localize authentik-redis container (#309)

## Summary

- Replace upstream `docker.io/library/redis:7-alpine` (Redis 7.4.8) with a nix-built container using Redis 8.2.3 from nixpkgs
- Introduce **attached service pattern**: `parent` field in service-versions.yaml, `<parent>-<component>` naming convention, and `assert pkgs.redis.version == version` in default.nix to prevent silent version drift on `flake.lock` updates
- Document the pattern in [[review-services]] so future attached services slot in cleanly
- Backfill `parent: grafana` on existing `grafana-sidecar` entry

## Version drift protection

1. `flake.lock` update bumps nixpkgs redis → `assert` in `default.nix` breaks `nix-build`
2. Developer updates `version` in `default.nix` → prek's `container-version-check` demands matching `service-versions.yaml` update
3. Both must agree before commit succeeds

## Test plan

- [ ] Build container from branch on ringtail (`mise run container-build-and-release authentik-redis`)
- [ ] Update kustomization `newTag` to branch-built image tag
- [ ] Sync authentik ArgoCD app from branch (`argocd app set authentik --revision localize-redis && argocd app sync authentik`)
- [ ] Verify Authentik login, session persistence, and task queue still work
- [ ] After merge: C0 follow-up to update `newTag` to the main-built image tag

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #309

containers/authentik-redis/default.nix

@@ -0,0 +1,29 @@
+# Nix-built Redis for Authentik
+# Attached service: cache/broker (sessions, Celery task queue, caching)
+# Uses Redis from nixpkgs, packaged with dockerTools.buildLayeredImage
+#
+# The version assertion ensures nix-build fails if a flake.lock update
+# changes the Redis version — forcing an explicit version acknowledgment
+# here and in service-versions.yaml (enforced by container-version-check).
+{ pkgs ? import <nixpkgs> { } }:
+
+let
+  version = "8.2.3";
+in
+
+assert pkgs.redis.version == version;
+
+pkgs.dockerTools.buildLayeredImage {
+  name = "blumeops/authentik-redis";
+  contents = [
+    pkgs.redis
+  ];
+
+  config = {
+    Entrypoint = [ "${pkgs.redis}/bin/redis-server" ];
+    Cmd = [ "--protected-mode" "no" ];
+    ExposedPorts = {
+      "6379/tcp" = { };
+    };
+  };
+}