Production hardening: Swagger gating, Redis persistence, image and code scanning

Remaining production-readiness items: disable or gate Swagger UI and the `/api-docs/*` proxy
routes in the prod profile; volumes + AOF for all Redis instances (today a restart loses live
games and queues); Trivy image scanning and CodeQL/semgrep in CI.