fix(operator): forward default Redis password to MCPServer and MCPRemoteProxy

[reyortiz3]

Summary

• When the operator's global Redis default (operator.defaultRedis / global.redis) is used because spec.sessionStorage is unset, MCPServer and MCPRemoteProxy pods received the default Redis address but never the default password, so they crash-looped against an authenticated Redis/Valkey instance with NOAUTH Authentication required.
• VirtualMCPServer already handled this correctly by falling back to TOOLHIVE_DEFAULT_REDIS_SECRET_NAME/TOOLHIVE_DEFAULT_REDIS_SECRET_KEY in buildRedisPasswordEnvVar when spec.sessionStorage is nil.
• This mirrors that same fallback into MCPServerReconciler.buildRedisPasswordEnvVar and buildRedisPasswordEnvVarForRemoteProxy, so address and credential always travel together for the global-default path, while an explicit spec.sessionStorage on any of the three kinds remains authoritative and never falls through to the global default.
• The password is still only ever injected via secretKeyRef — never copied into the pod spec as plaintext.

Fixes stacklok/stacklok-enterprise-platform#4310

Test plan

• Added TestMCPServerBuildRedisPasswordEnvVar_GlobalDefault, _NonRedisProviderNotOverriddenByGlobal, and _PasswordlessGlobalDefault (mirrors the existing VirtualMCPServer coverage).
• Added the same three cases for MCPRemoteProxy as TestBuildRedisPasswordEnvVarForRemoteProxy_GlobalDefault, _NonRedisProviderNotOverriddenByGlobal, _PasswordlessGlobalDefault.
• go test ./cmd/thv-operator/controllers/... passes.
• go build ./cmd/thv-operator/... passes.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.16%. Comparing base (158e671) to head (ec2b386).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6679      +/-   ##
==========================================
- Coverage   79.20%   79.16%   -0.04%     
==========================================
  Files         789      789              
  Lines       79028    79054      +26     
==========================================
- Hits        62597    62586      -11     
- Misses      16426    16463      +37     
  Partials        5        5              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jhrozek]

Reviewed via Claude Code — small, well-scoped fix that mirrors VirtualMCPServer's existing buildRedisPasswordEnvVar fallback logic exactly for MCPServer and MCPRemoteProxy. Explicit sessionStorage correctly short-circuits and never falls through to the global default; secret is injected via SecretKeyRef, never plaintext. Test coverage mirrors the sibling VirtualMCPServer suite (global-default injection, non-redis-provider not overridden, passwordless-default no-op). No architecture doc updates needed — this brings two controllers in line with a third's already-documented behavior.