Port Redis appliance to TurnKey 19 - #13

The inherited Node.js control-panel configuration contacts the npm registry before the product configuration phase. Without an early npm CA setting, the TKLDev inspection proxy caused every registry request to fail with SELF_SIGNED_CERT_IN_CHAIN.

Register the existing product overlay in the common-overlay phase and provide npm with the system CA bundle, matching the completed Node.js v19 pattern. The final product configuration still removes the temporary global npm configuration after copying the managed CA setting to the node account.

Verified against retained build run 20260824t095632z-4268-9544 plus shell syntax, npmrc content and git diff whitespace checks.

The imported appliance can start Nginx while the common certificate hook is replacing the default certificate and key. If that initial start sees the pair between writes, Nginx fails, and the common hook skips it because it only restarts active services. This leaves the documented Redis Commander HTTPS interface unavailable on an otherwise successful boot.

Restart Nginx from the later Redis firstboot hook after certificate generation has completed. This keeps the correction in the application startup path and makes firstboot fail visibly if the final Nginx configuration is unusable.

Diagnosed from retained acceptance run 20260824t101037z-1960-16911: Nginx reported a private-key mismatch, remained failed after certificate regeneration, and the first HTTPS request exited with status 7. Shell syntax and diff whitespace checks pass.

Redis Commander 0.9 replaced the legacy HTTP Basic challenge with a public login page and bearer-protected APIs. The initial v19 test carried forward the v18 root-page 401 assumption, so it failed after Nginx and the underlying Redis flow were already healthy.

Wait briefly for the PM2 application to accept connections, verify anonymous denial on the protected connections API, sign in with the firstboot administrator credential, and query the configured Redis connection with the returned bearer token. Update the disposable updater fixture to prove both the 0.8 legacy login and the 0.9 token flow, and record the observed upstream dependency notices for release review.

Verified shell syntax and documentation policy. A disposable Debian Trixie fixture upgraded Redis Commander 0.8.0 to registry candidate 0.9.0, authenticated through both generations, queried the protected current API, retained lock integrity, and preserved Redis data.

Capture the exact passing source and harness revisions, archive and tree hashes, installed versions, retained report location, and artifact checksum result. Align the documented disposable updater command with the rerun that exercised Redis Commander 0.8 legacy authentication and the current 0.9 form and token flow.

This is an evidence-only update. Product behavior remains the exact source accepted by run 20260824t112332z-4695-11523.