ci(unit-tests-webapp): set REDIS_HOST/REDIS_PORT to satisfy marqs eager-init env check

Background. webapp's `app/v3/marqs/index.server.ts` and the related
`app/v3/services/taskRunConcurrencyTracker.server.ts` build their
clients via `singleton(name, getValue)` — and `singleton` evaluates
`getValue()` eagerly, so the Redis env check (`if (!env.REDIS_HOST ||
!env.REDIS_PORT) throw …`) fires at module load.

Why this PR triggers it. The slim-AuthenticatedEnvironment refactor
plus the new `personalAccessToken.server.ts → rbac.server.ts` import
chain extended triggerTask.test.ts's transitive import graph through
`auth.server.ts → emailAuth.server.tsx → email.server.ts →
commonWorker.server.ts`, which in turn loads marqs-using V1 services,
ultimately reaching `marqs/index.server.ts` and the tracker. Locally
this stayed hidden because `.env` provides REDIS_HOST=127.0.0.1; in CI
shards 1/2/4/5/6/7 the throw blew up triggerTask.test.ts at module
load, taking the rest of the shard with it via vitest's fail-fast.

Why a CI env injection rather than touching code. The proper fix —
deferring the Redis singletons in marqs/* and tracker — sits in V1
no-touch territory (CLAUDE.md: "marqs/ directory: never modify"), and
the rest of the offending chain (commonWorker → V1 services) is a
fundamental webapp coupling we don't want to tackle from a PR scoped
to RBAC refactoring. The placeholder values match the existing pattern
for DATABASE_URL / DIRECT_URL / CLICKHOUSE_URL — they just need to be
truthy so the singleton's env check passes. ioredis is lazy-connect,
so no real Redis daemon is contacted (and unit tests don't invoke any
tracker / marqs methods that would force a connection).

Verified locally: `REDIS_HOST=127.0.0.1 REDIS_PORT=6379 pnpm vitest
run test/engine/triggerTask.test.ts` passes 8/8. The architectural
mess (any test reaching apiAuth → commonWorker pulls REDIS-required
modules) deserves its own follow-up — see TODO once the right scope
is identified.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: matt-aitken

.github/workflows/unit-tests-webapp.yml

@@ -105,6 +105,16 @@ jobs:
           ENCRYPTION_KEY: "dummy-encryption-keeeey-32-bytes"
           DEPLOY_REGISTRY_HOST: "docker.io"
           CLICKHOUSE_URL: "http://default:password@localhost:8123"
+          # marqs/index.server.ts and taskRunConcurrencyTracker.server.ts
+          # eager-init Redis-backed singletons at module load and throw if
+          # these are unset. CI doesn't run a real Redis (testcontainers
+          # provision them per-test on demand); the values just need to be
+          # truthy so the singleton's env check passes. ioredis lazy-connects,
+          # so no real connection is attempted unless a test calls into the
+          # tracker / marqs (which the unit tests don't).
+          REDIS_HOST: "127.0.0.1"
+          REDIS_PORT: "6379"
+          REDIS_TLS_DISABLED: "true"
 
       - name: Gather all reports
         if: ${{ !cancelled() }}