Add redis shell command for interactive Redis CLI access

[dmonroy]

Problem

There's no way to open an interactive redis-cli session against an app's Redis instance today. db shell provides this for the database via a dedicated utility image/task running inside the VPC; no equivalent exists for Redis.

Current workaround

apppack config get REDIS_URL retrieves the connection string, but reaching it requires VPC-level access. ps exec <service> --live can get a shell in a running app container that already has network access, but only works if that container happens to have redis-cli installed.

Proposed implementation

Mirror db shell's architecture (app/db.go's DBShellTaskInfo() -> StartInteractiveShell, cmd/db.go's dbShellCmd):

• A small utility image bundling redis-cli
• A registered ECS task family for it, similar to apppack-db-utils
• New cmd/redis.go with a redisShellCmd, and a RedisShellTaskInfo()-equivalent method wired to the app's REDIS_URL config var

Repo

apppack (CLI) -- would also need a small utility image (new repo or extending an existing one) and possibly apppack-backend changes to register/support the task.

[blsmth]

Implementation notes / cross-repo breakdown (mirrors how db shell is wired end to end):

1. apppack-backend — task definition
formations/formations/app/addons/redis.py: add a RedisShellTaskDefinition modeled on DatabaseUtilsShellTaskDefinition in addons/database.py (~L561-591):

• Family=Join("-", [name, "redisshell"]), Cpu 256 / Memory 512
• Secrets=[ecs.Secret(Name="REDIS_URL", ValueFrom=redis_url_parameter_name)] (also inject REDIS_PREFIX)
• Command=["/bin/sh"] overridden by the CLI, NetworkMode=If("IsFargate", "awsvpc", "bridge")
• Same review-app duplication caveat applies ([ECS] [request]: Support Run Task Containeroverrides for task definition secret override. aws/containers-roadmap#1269), so review apps get <name>-pr<N>-redisshell, and the operator role needs ecs:RunTask on ${Name}-pr*-redisshell (pattern at database.py L459-478).
• Exec role already reads /apppack/${Type}s/${Name}/config/* (app/execute.py L364) — verify that covers the REDIS_URL SecureString written by RedisEncryptedParameterCustomResource.

2. apppack-backend — settings plumbing
formations/formations/app/config.py (~L487) builds the DynamoDB settings blob with a dbutils section. Add a parallel redis section carrying shell_task_family, gated on the Redis condition.

3. Utility image
db shell uses public.ecr.aws/d9q4v8a4/apppack-db-utils:<engine>. Cheapest path is a redis tag in that same repo rather than a new image repo. It must be a TLS-enabled redis-cli build — Elasticache user auth means the URL is rediss://.

4. apppack (CLI)

• app/app.go: add Redis struct { ShellTaskFamily string } to Settings (alongside DBUtils, L112-117), plus RedisShellTaskInfo() mirroring DBShellTaskInfo() (L1136) — returns family + redis-cli -u $REDIS_URL, with the -pr<N>-redisshell family for review apps.
• cmd/redis.go: redisCmd + redisShellCmd calling StartInteractiveShell(...), same shape as dbShellCmd in cmd/db.go (L77-90).

5. Docs
apppack-docs command reference is generated from apppack docgen, so it picks the command up automatically — but the ACL caveat below is worth a prose note.

ACL caveat worth surfacing in help text: the Redis user is created with on +@all -@dangerous +keys +info ~<name>/*. Keys are namespaced, so an interactive session must prefix everything with $REDIS_PREFIX, and @dangerous commands (FLUSHALL, CONFIG, etc.) will be rejected. Worth printing the prefix on shell start so it isn't a surprise.

[ipmb]

DB images are managed here, https://github.com/apppackio/apppack-db-utils