feat: Phase 1 MVP — complete AgentIdP implementation

Implements all P0 features per OpenSpec change phase-1-mvp-implementation:
- Agent Registry Service (CRUD) — full lifecycle management
- OAuth 2.0 Token Service (Client Credentials flow)
- Credential Management (generate, rotate, revoke)
- Immutable Audit Log Service

Tech: Node.js 18+, TypeScript 5.3+ strict, Express 4.18+, PostgreSQL 14+, Redis 7+
Standards: OpenAPI 3.0 specs, DRY/SOLID, zero `any` types
Quality: 18 unit test suites, 244 tests passing, 97%+ coverage
OpenAPI: 4 complete specs (14 endpoints total)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/cache/redis.ts

@@ -0,0 +1,47 @@
+/**
+ * Redis client singleton for SentryAgent.ai AgentIdP.
+ * Used for token revocation tracking, rate limiting, and monthly token counts.
+ */
+
+import { createClient, RedisClientType } from 'redis';
+
+let redisClient: RedisClientType | null = null;
+
+/**
+ * Returns the singleton Redis client instance.
+ * Initialises and connects the client on first call using REDIS_URL from env.
+ *
+ * @returns Promise resolving to the connected Redis client.
+ * @throws Error if REDIS_URL is not set or connection fails.
+ */
+export async function getRedisClient(): Promise<RedisClientType> {
+  if (!redisClient) {
+    const url = process.env['REDIS_URL'];
+    if (!url) {
+      throw new Error('REDIS_URL environment variable is required');
+    }
+
+    redisClient = createClient({ url }) as RedisClientType;
+
+    redisClient.on('error', (err: Error) => {
+      // eslint-disable-next-line no-console
+      console.error('Redis client error', err);
+    });
+
+    await redisClient.connect();
+  }
+  return redisClient;
+}
+
+/**
+ * Disconnects the Redis client and resets the singleton.
+ * Used for graceful shutdown and tests.
+ *
+ * @returns Promise that resolves when the client is disconnected.
+ */
+export async function closeRedisClient(): Promise<void> {
+  if (redisClient) {
+    await redisClient.quit();
+    redisClient = null;
+  }
+}