fix(auth): switch to K8s Redis, add claude.ai/chatgpt CORS origins

- REDIS_URL → K8s ClusterIP with auth (fixes silent hang on host Redis)
- Socket timeouts (connectTimeout 3s, socketTimeout 5s) on Redis client
- Add claude.ai, chatgpt.com, chat.openai.com to CORS allowlist
- Update hermes-mcp image SHA (includes above changes)
- Add squaremcp-broker-demo.mp4 to site Dockerfile; bump site image SHA

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/index.ts

@@ -89,6 +89,9 @@ const SQUAREMCP_ALLOWED_ORIGINS = new Set([
   'https://www.squaremcp.com',
   'https://app.squaremcp.com',
   'https://tiktok.squaremcp.com',
+  'https://claude.ai',
+  'https://chatgpt.com',
+  'https://chat.openai.com',
 ]);
 
 type PilotRequestBody = {

src/redis.ts

@@ -1,6 +1,10 @@
 import { createClient } from 'redis';
 
-const redis = createClient({ url: process.env.REDIS_URL });
+const redis = createClient({
+  url: process.env.REDIS_URL,
+  socket: { connectTimeout: 3000, socketTimeout: 5000 },
+});
+redis.on('error', (err) => console.error('[redis] error:', err.message));
 redis.connect().catch((err) => console.error('[redis] connect error:', err));
 
 export default redis;