feat(caching): add Redis Sentinel/Cluster support for HA session and cache layer

.env.example

@@ -155,9 +155,36 @@ REDIS_PORT=6379
 # Format: redis://[user:password@]host:port[/db]
 REDIS_URL=
 
+# Password for standalone/Sentinel/Cluster connections (optional)
+REDIS_PASSWORD=
+
 # Separate Redis URL for Bull job queue (uses different DB)
 QUEUE_REDIS_URL=
 
+# ── High Availability: Redis Sentinel (optional) ──────────────────────────
+# When set, the shared Redis connection (session, caching, threat detection,
+# distributed locks, upload progress) connects via Sentinel instead of
+# REDIS_HOST/REDIS_PORT, so failover to a promoted replica does not require
+# an application restart. Takes effect only when REDIS_CLUSTER_NODES is unset.
+
+# Comma-separated list of sentinel host:port pairs
+# Example: sentinel1:26379,sentinel2:26379,sentinel3:26379
+REDIS_SENTINEL_HOSTS=
+
+# Sentinel master group name
+REDIS_SENTINEL_NAME=mymaster
+
+# Password for the sentinel nodes themselves (optional, separate from REDIS_PASSWORD)
+REDIS_SENTINEL_PASSWORD=
+
+# ── High Availability: Redis Cluster (optional) ────────────────────────────
+# When set, the shared Redis connection connects to a Redis Cluster for
+# sharding. Takes precedence over REDIS_SENTINEL_HOSTS if both are set.
+
+# Comma-separated list of cluster seed node host:port pairs
+# Example: node1:7000,node2:7001,node3:7002
+REDIS_CLUSTER_NODES=
+
 # ─────────────────────────────────────────────────────────────────────────────
 # 5. EMAIL & SMTP
 # ─────────────────────────────────────────────────────────────────────────────