feat(litellm): add Redis for router state/rate-limits/budgets/cache

New redis service (redis:7-alpine, password-protected, no persistence
volume — everything it holds is cache/coordination state). litellm gets
REDIS_HOST/REDIS_PORT/REDIS_PASSWORD, which is all LiteLLM needs to use it
for router state, rate limits/budgets, and cache invalidation — no
litellm-config.yaml block required (docs.litellm.ai/docs/proxy/caching).
REDIS_PASSWORD added to .env.example and update.sh's auto-generated
secrets.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -143,6 +143,8 @@ services:
         condition: service_healthy
       llama-server:
         condition: service_started
+      redis:
+        condition: service_healthy
     volumes:
       - ./litellm-config.yaml:/app/config.yaml:ro
     # LITELLM_MASTER_KEY / LITELLM_SALT_KEY come straight from .env via env_file
@@ -151,6 +153,12 @@ services:
     env_file: .env
     environment:
       - DATABASE_URL=postgresql://litellm:${LITELLM_DB_PASSWORD}@litellm-db:5432/litellm
+      # Setting these is all LiteLLM needs to use Redis for router state,
+      # rate limits/budgets, and cache invalidation — no extra config.yaml
+      # block required. See https://docs.litellm.ai/docs/proxy/caching.
+      - REDIS_HOST=redis
+      - REDIS_PORT=6379
+      - REDIS_PASSWORD=${REDIS_PASSWORD}
     # The litellm container only joins the ai-stack bridge network, which has
     # no visibility into the LAN's mDNS/local-DNS names — search.home won't
     # resolve without this. Set SEARXNG_LAN_IP in .env to its stable LAN IP
@@ -191,6 +199,22 @@ services:
       timeout: 5s
       retries: 10
 
+  # Backs litellm's router state, rate limits/budgets, and cache
+  # invalidation (see the litellm service's REDIS_* env vars above).
+  # ponytail: no persistence volume — everything litellm stores here is
+  # cache/coordination state it's fine to lose on restart, not source data.
+  redis:
+    image: redis:7-alpine
+    container_name: redis
+    command: ["redis-server", "--requirepass", "${REDIS_PASSWORD}"]
+    restart: unless-stopped
+    networks: [ai-stack]
+    healthcheck:
+      test: ["CMD-SHELL", "redis-cli -a ${REDIS_PASSWORD} ping | grep -q PONG"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
   # Separate Postgres instance (with the pgvector extension) for the
   # knowledgebase — NOT the same database as litellm-db, which is plain
   # postgres:16-alpine and has no vector extension installed. See