Keep flow state across a restart, and tighten the flow typing

The engine fell back to MemoryState because there was no Redis to talk
to, so every value was lost on restart. Adds a redis service with
append-only persistence, reachable only from the backend, and points
REDIS_HOST at it.

state.py and pipeline.py leave the strict-mypy exclusion. redis-py types
its calls as sync/async unions; the casts narrow that at the points of
use rather than switching to redis.asyncio, which would make a
deliberately synchronous backend asynchronous. nodes.py stays excluded.

The .env.example CORS entry belongs with the CI work that follows.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KkmeRiyeYmVZqJVwuyHq9o

.env.example

@@ -15,7 +15,9 @@ PROJECT_NAME="Fluksio"
 STACK_NAME=fluksio-app
 
 # Backend
-BACKEND_CORS_ORIGINS="http://localhost,http://localhost:5173,http://app.localhost,https://localhost,https://localhost:5173"
+# `http://frontend` is the compose-network origin the Playwright job loads the
+# SPA from (docker/compose.ci.yml); without it every spec fails CORS at login.
+BACKEND_CORS_ORIGINS="http://localhost,http://localhost:5173,http://app.localhost,https://localhost,https://localhost:5173,http://frontend"
 SECRET_KEY=changethis
 FIRST_SUPERUSER=admin@fluksio.com
 FIRST_SUPERUSER_PASSWORD=changethis
@@ -36,6 +38,11 @@ POSTGRES_DB=app
 POSTGRES_USER=postgres
 POSTGRES_PASSWORD=changethis
 
+# Redis — flow engine state. Empty keeps the state in memory; the compose stack
+# points the backend at its own `redis` service.
+REDIS_HOST=
+REDIS_PORT=6379
+
 SENTRY_DSN=
 
 # Docker registry images