feat(paperless-ngx): optional valkey subchart, password from the redis item

paperless-ngx cannot run without a Redis - PAPERLESS_REDIS is the Celery
broker - so every installation needed a second Helm release whose address
lived in a 1Password item and in neither chart. This adds our own published
valkey chart as an optional dependency, off by default and gated on
valkeySubchart.enabled (not valkey.enabled, which the subchart's strict
schema rejects and which Helm would only have complained about for whoever
first switched it on). Additive, default behaviour unchanged: minor,
12.1.3+up3.2.1 -> 12.2.0+up3.2.1.

Configured as a QUEUE (PVC + noeviction, the subchart's defaults), unlike
stalwart's cache. Read off the 3.2.1 source rather than assumed: one
PAPERLESS_REDIS url serves five consumers - the Celery broker, the result
backend (Redis in 3.x, the database before), the channels pub/sub layer and
two Django caches. allkeys-lru would not be a trade here but actively wrong,
because LRU evicts typeless across the whole keyspace and a backlog of
waiting consume tasks is exactly what it reads as cold; a dropped task is a
document silently never processed. The price, named in values.yaml rather
than smoothed over: two of the five consumers are caches, so a full instance
refuses writes - new tasks included - and the answer is memory sizing, not a
policy change. All three cache-like consumers are TTL-bounded, which is what
keeps that price small.

The password comes from the SAME item as the Redis connection, in a third
field auth-conf holding the complete line "requirepass <password>". It cannot
DEFAULT to secrets.redisSecretRef, and that is a property of Helm, not an
omission: a values.yaml is never templated and a parent cannot compute a
subchart's value. Measured - a template expression there lands verbatim in
the subchart's itemPath and fails as a YAML parse error naming neither the
value nor the cause.

Forgetting it is therefore caught in values.schema.json, by a conditional
rule rather than a fail() in a template. Also measured, and the reason:
Helm renders a subchart's templates BEFORE the parent's, so a guard in this
chart loses the race to the subchart's own required(), which reports
"secrets.authSecretRef" and cannot know the path belongs to the redis item.
A check that cannot fire is the mistake found while testing #77, so the
first draft of that guard was removed rather than shipped. The schema runs
before any rendering and names /valkey/secrets/authSecretRef.

One trap found while testing and closed here: "valkeySubchart: null" DELETES
the key, Helm then cannot resolve the condition path and treats the
dependency as ENABLED - so erasing the switch turned the subchart on with no
password set. Unlike every other block in this chart (issue #99), that one
is rejected by the schema instead of defaulting.

The install-test now runs with the subchart ON and the throwaway redis
Deployment removed: the url in the fixtures names ci-valkey-service, so the
bundled Valkey is the broker the release actually uses. #65 covered this
path by a render only - deliberately, since an unused Valkey would have made
that test look like it covered clustering. This is the first real
installation of the valkey-subchart path.

Documented, not glossed: the password now sits in that item twice and a
rotation has to touch both fields; with the subchart on the vault url is a
mandatory step, not a hint; and a OnePasswordItem materializes every field
of its item, so both Secrets carry all three keys - untidy, harmless, and
written down so nobody "tidies it up".

Fixes #78

paperless-ngx/Chart.yaml

@@ -5,9 +5,86 @@ icon: https://raw.githubusercontent.com/paperless-ngx/paperless-ngx/dev/src-ui/s
 
 type: application
 
-version: 12.1.3+up3.2.1
+version: 12.2.0+up3.2.1
 
 appVersion: 3.2.1
 
 maintainers:
-  - name: jklein
+  - name: jklein
+
+# The third chart in this repo with a dependency (after ytdlp-web-player and
+# stalwart). README, "Chart dependencies", holds the bar a dependency has to
+# clear and the full price list; what is repeated here is only what is specific
+# to THIS chart, because the generic half is already written down twice.
+#
+# WHY ONE HERE. paperless-ngx cannot run without a Redis: PAPERLESS_REDIS is
+# the Celery broker, and without it the web UI comes up looking healthy while
+# consumption, OCR, the scheduled tasks and the index updates never run. So
+# every installation needs one, and before this block the only way to have one
+# was a second Helm release whose address lived in a 1Password item and in
+# neither chart.
+#
+# WHY IT IS OFF BY DEFAULT: an installation that already has a Redis (or wants
+# a shared one, which is what secrets.redisSecretRef' key-prefix field exists
+# for) points redis-connection-url at it, and this dependency renders nothing.
+# The subchart is the path for an installation that has none.
+#
+# THE SUBCHART IS OUR OWN valkey CHART, resolved from the published index - not
+# upstream's. So README guideline 14.2 ("we consume their chart as it comes")
+# does not apply and there are no third-party defaults to leave unpatched: the
+# subchart follows this repo's conventions because it IS this repo's chart.
+# What does apply in full is the subchart being invisible to everything
+# downstream that watches Helm release versions, and the PR-ordering hazard
+# below.
+dependencies:
+  - name: valkey
+    # KEEP THIS VERSION MOVING - it is the only path a Valkey update has into a
+    # cluster through this chart. The version declared here is baked into our
+    # packaged .tgz, so anything watching Helm release versions (Fleet
+    # included) sees only "paperless-ngx": a new valkey chart, a security fix
+    # included, arrives ONLY when this line is raised and a new paperless-ngx
+    # version is published. Nothing reports the gap.
+    #
+    # Renovate's BUILT-IN helmv3 manager reads this block and opens the PR, and
+    # ci/renovate-bump-chart.sh bumps this chart's patch version, which is what
+    # actually ships it. No customManagers entry exists or would help - that
+    # manager is for exactly this case, where repository and version sit
+    # together in one file. Measured for Gitea #65 against our self-hosted
+    # index (Renovate 44.132.2, dry run with the dependency pinned low:
+    # newVersion "1.0.0+up9.1.2.alpine", versioning "helm"), so the chain is
+    # proven for this registry and this build-metadata suffix and was not
+    # re-measured here.
+    #
+    # Independent of appVersion: raising it is a patch or minor bump of this
+    # chart and is never tied to the paperless-ngx image.
+    version: "1.0.0+up9.1.2.alpine"
+    # Our own published index, and the READ path only - anonymously readable
+    # (measured), so ci/helm-dependencies.sh needs no credential and was not
+    # touched. The publish target and its credentials still live in 1Password
+    # and appear nowhere in this repository; see README, "CI/CD".
+    repository: "https://git.jk-dev.de/api/packages/jlab-cluster/helm"
+    # Off by default, so a plain install renders none of its objects.
+    #
+    # NOT "valkey.enabled", AND THAT IS NOT A STYLE CHOICE. Everything under
+    # the "valkey:" key is handed to the subchart as ITS values and validated
+    # against ITS schema, and our valkey chart ships additionalProperties:
+    # false with no "enabled" property:
+    #   Error: values don't meet the specifications of the schema(s) in the
+    #   following chart(s): valkey: - at '': additional properties 'enabled'
+    #   not allowed
+    # Worse, Helm skips a DISABLED subchart's schema validation, so with the
+    # default of false that error would stay invisible through lint, render and
+    # install-test and surface only for whoever first switched it on - the one
+    # case the value exists for. The condition is therefore a key of OUR OWN,
+    # outside the subchart's value subtree.
+    condition: valkeySubchart.enabled
+#
+# !!! NEVER CHANGE valkey/ AND THIS CHART IN THE SAME PULL REQUEST !!!
+#
+# The dependency resolves out of the PUBLISHED index, not out of the working
+# tree, and valkey/ is published only by a push to main that touches it. A
+# single PR carrying both therefore runs lint, package, render AND the
+# install-test against the OLD valkey .tgz and goes green about an artifact
+# that is not the one in the diff. Two consecutive pull requests: change
+# valkey/, merge, let it publish, then raise the version here. README, "Chart
+# dependencies", and the wiki's valkey page carry the long form.