Retrofitted every internal cache instance with network isolation and encrypted connections

Every internal cache instance across the platform now requires a password (closed earlier), restricts which pods can even reach it at the network layer, and - for all but one instance whose underlying service is already being retired - encrypts the connection end to end. The one holdout is intentional: it's waiting on an upstream migration that removes its cache dependency entirely rather than hardening infrastructure about to be dropped.