fix(relay): enable Redis TLS for rediss:// (ElastiCache)

[tlongwell-block]

Problem

The relay crashes at startup on the bb-block (prod) cluster:

Error: Redis pool creation failed: Config: Redis: can't connect with TLS, the feature is not enabled - InvalidClientConfig

Prod ElastiCache is addressed via rediss:// (TLS), but the redis crate was compiled with no TLS feature (tokio-comp, connection-manager only). Local/dev uses plaintext redis://, so this never surfaced there — same shape as the S3/IRSA fix (#1406): a prod-only path dev never exercised.

This is the blocker after #1406 — kubectl confirms the relay now gets past S3/git (Postgres connects, migrations run, owner bootstrapped) and dies at Redis pool creation.

Fix — two coupled parts

Empirically, either part alone is insufficient:

1. Enable TLS in the redis dep — add tokio-rustls-comp so the client can negotiate TLS for rediss://.
2. Install a rustls CryptoProvider at relay startup — with the TLS feature on, both aws-lc-rs and ring are compiled in transitively, so rustls cannot auto-select a provider and panics at first TLS use. We install ring explicitly in main(), mirroring buzz-acp's existing rustls setup for wss://.

A probe confirmed adding only the feature swaps the clean startup error for a runtime panic in CryptoProvider::get_default_or_install_from_crate_features() — hence both parts.

Blast radius

• Plaintext redis:// (local/dev) is unchanged: the TLS path is only taken for rediss:// URLs; the provider install is a cheap no-op otherwise.
• Provider install is process-wide and idempotent-safe (install_default() runs once at the top of main(), before any TLS is attempted — Redis, wss, or S3-over-TLS).

Files

• Cargo.toml — add tokio-rustls-comp to the workspace redis dep
• crates/buzz-relay/Cargo.toml — add rustls (ring, std) dep
• crates/buzz-relay/src/main.rs — install ring provider at startup
• Cargo.lock

Validation

• cargo test -p buzz-relay — 428 pass; the one Redis integration test (redis_presence_publish...) times out only under parallel full-suite pool contention and passes cleanly in isolation (env-dependent, not this change).
• cargo fmt --check ✅ · cargo clippy -p buzz-relay ✅
• Pre-push hook rust-tests green (99s).

Deploy path

After this merges and the image builds, a third bb-block PR bumps the relay image tag. Deploy is not declared fixed until the pod is observed Running/Ready via read-only kubectl.