Encrypt ThinkFeedback's cache connection once its upstream drops Redis

ThinkFeedback (Quackback) is the one internal cache consumer not yet moved to an encrypted connection. Its client hardcodes the cache connection options with no hook for a custom certificate authority, and the deployed release runs on the Bun runtime rather than Node, where the usual env-var-only trust workaround isn't confirmed to work - so hardening it now would mean patching upstream source for infrastructure that's already scheduled to disappear.

Quackback's own main branch has already replaced its cache-backed job queue with a Postgres-backed one (merged 2026-08-21), but no tagged release includes it yet as of this writing (latest is v0.13.2, from 2026-08-01). The deployment already tracks new 0.x releases automatically via ArgoCD Image Updater. Plan: wait for a release past that migration, at which point the cache dependency - and this ticket - goes away entirely rather than needing a TLS retrofit.