Redis sizing

A submission draft lives in Redis for up to 2 hours, Fernet-encrypted with a key that exists only in the whistleblower's cookie. Attachments make it large:

Set maxmemory with maxmemory-policy noeviction (docker-compose.prod.yml uses 1 GB): an evicting policy could drop sessions and rate-limit counters. Past DRAFT_REDIS_MEMORY_PERCENT, new draft attachments are refused so the rest of Redis keeps working.