feat: redis, fileserver, httpclient 런타임 시점 구현 추가

docs/registries/env-keys.yaml

@@ -540,6 +540,18 @@ env_keys:
     compatibility_impact: behavior-change
     required_test: outbound-contract:global-call-timeout-bounded
 
+  - name: APP_OUTBOUND_HTTP_MAXIMUM_IN_FLIGHT_CALLS
+    type: int
+    default: 128
+    allowed_values: null
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: httpclient-production-capability
+    validation: int_range_1_10000
+    compatibility_impact: additive
+    required_test: outbound-contract:maximum-in-flight-calls-bounded
+
   - name: APP_OUTBOUND_HTTP_RETRY_ENABLED
     # source: feature-outbound-http-client-baseline 2026-05-22
     # "retry 기본값은 disabled이며, 활성화 시 retryable registry error와 low-cardinality retry metric이 필수"
@@ -1230,6 +1242,18 @@ env_keys:
     compatibility_impact: behavior-change
     required_test: adapter-contract:redis-disabled-default
 
+  - name: APP_CACHE_REDIS_CLIENT_MODE
+    type: enum
+    default: managed
+    allowed_values: [managed, external]
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: redis-production-capability
+    validation: enum_strict
+    compatibility_impact: additive
+    required_test: adapter-contract:redis-client-mode-explicit
+
   - name: APP_CACHE_REDIS_HOST
     # source: feature-cache-consistency-contract — Redis adapter (활성화 시 endpoint 필요)
     type: string
@@ -1256,6 +1280,102 @@ env_keys:
     compatibility_impact: behavior-change
     required_test: cache-contract:redis-port-bound
 
+  - name: APP_CACHE_REDIS_PASSWORD
+    type: string
+    default: null
+    allowed_values: null
+    classification: secret
+    required: false
+    reload_policy: restart-only
+    owner_branch: codex-phase-a-ci-recovery
+    validation: must_not_be_local_dev_sentinel_in_prod
+    compatibility_impact: additive
+    required_test: secrets-contract:redis-password-no-leak
+
+  - name: APP_CACHE_REDIS_KEY_HMAC_SECRET
+    type: string
+    default: null
+    allowed_values: null
+    classification: secret
+    required: false
+    reload_policy: restart-only
+    owner_branch: codex-phase-a-ci-recovery
+    validation: base64_min_32_bytes_when_redis_enabled
+    compatibility_impact: additive
+    required_test: cache-contract:redis-hmac-secret-bounded
+
+  - name: APP_CACHE_REDIS_COMMAND_TIMEOUT
+    type: duration
+    default: 2s
+    allowed_values: null
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: codex-phase-a-ci-recovery
+    validation: spring_duration_shorthand_non_zero_le_30s
+    compatibility_impact: additive
+    required_test: cache-contract:redis-command-timeout-bounded
+
+  - name: APP_CACHE_REDIS_MAXIMUM_QUEUED_COMMANDS
+    type: int
+    default: 8
+    allowed_values: null
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: codex-phase-a-ci-recovery
+    validation: int_1_to_4096
+    compatibility_impact: additive
+    required_test: cache-contract:redis-command-queue-bounded
+
+  - name: APP_CACHE_REDIS_MAXIMUM_IN_FLIGHT_BYTES
+    type: int
+    default: 16777216
+    allowed_values: null
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: codex-phase-a-ci-recovery
+    validation: covers_maximum_value_and_le_268435456
+    compatibility_impact: additive
+    required_test: cache-contract:redis-command-byte-admission-bounded
+
+  - name: APP_CACHE_REDIS_NAMESPACE_ENVIRONMENT
+    type: string
+    default: local
+    allowed_values: null
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: codex-phase-a-ci-recovery
+    validation: lowercase_slug
+    compatibility_impact: behavior-change
+    required_test: cache-contract:redis-namespace-environment-bound
+
+  - name: APP_CACHE_REDIS_SEMANTIC_REGION
+    type: string
+    default: default
+    allowed_values: null
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: codex-phase-a-ci-recovery
+    validation: lowercase_slug
+    compatibility_impact: behavior-change
+    required_test: cache-contract:redis-semantic-region-bound
+
+  - name: APP_CACHE_REDIS_MAXIMUM_VALUE_BYTES
+    type: int
+    default: 1048576
+    allowed_values: null
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: codex-phase-a-ci-recovery
+    validation: int_1_to_16777216
+    compatibility_impact: additive
+    required_test: cache-contract:redis-value-size-bounded
+
   - name: APP_CACHE_DEFAULT_TTL
     # source: feature-cache-consistency-contract 2026-05-22
     # "TTL | explicit per key family | no-cache for sensitive data | immortal cache forbidden"

docs/registries/secrets-classification.yaml

@@ -89,6 +89,18 @@ secrets:
     compatibility_impact: breaking
     required_test: secrets-contract:redis-password-no-leak
 
+  - name: APP_CACHE_REDIS_KEY_HMAC_SECRET
+    # Stable cache-key HMAC material. It is distinct from the Redis authentication credential.
+    classification: secret
+    source: secret-manager
+    rotation_policy: dual-read-restart-only
+    prod_default: null
+    dev_sentinel_prefix: __LOCAL_DEV_
+    owner_branch: codex-phase-a-ci-recovery
+    masking_rule: full
+    compatibility_impact: breaking
+    required_test: secrets-contract:redis-key-hmac-no-leak
+
   - name: APP_PRIVACY_PSEUDONYMIZATION_SALT
     # source: feature-data-retention-privacy-contract 2026-05-22
     # "pseudonymization key = HMAC-SHA-256 with rotating salt. salt rotation interval = 90일.