Bound the work-queue durability claim to the appendfsync window

Redis runs with appendfsync everysec, so an unclean stop loses up to a
second of journaled entries. Name that where the docstrings promised a
crash costs nothing, and state the setting and its trade-off on the
configuration page.

docs/reference/configuration.md

@@ -54,7 +54,13 @@ An instance that already has a managed venv keeps it on upgrade under
 | `REDIS_PORT` | `6379` | |
 
 Flow state is the last value of every message, node memory, and the run queue.
-Redis here is persistence, not a cache. Run it with append-only persistence on.
+Redis here is persistence, not a cache. Run it with append-only persistence on
+(`--appendonly yes`, which the compose stack sets).
+
+That writes with Redis's default `appendfsync everysec`, so an unclean stop of
+Redis or of its host loses up to a second of queued work. `appendfsync always`
+closes the window and cuts engine throughput to about a third, so the default
+stands.
 
 ## Identity and access