fix: expose the lighthouse queue redis over PrivateLink

[otsybizov]

🤖 Linear

Closes CONG-XXX

[Copilot]

Pull request overview

This PR enables the backend VPC (cartographer-handler) to reach the lighthouse queue Redis in the core VPC via AWS PrivateLink, and updates the mqclient Redis URL parsing to support TLS SNI override required for PrivateLink TLS verification.

Changes:

• Extend parseRedisUrl to support ?tlsServername=... for TLS SNI and add standard Redis connection retry/timeout settings.
• Add reusable Terraform PrivateLink modules (provider NLB + endpoint service, consumer interface endpoint + SG).
• Wire the modules into mainnet staging core/backend and update REDIS_URL to use the PrivateLink endpoint DNS.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
packages/adapters/mqclient/src/index.ts	Adds TLS SNI override via URL param and standard ioredis connection options.
ops/modules/privatelink/provider/variables.tf	Defines inputs for the PrivateLink provider module (NLB + endpoint service).
ops/modules/privatelink/provider/main.tf	Implements provider-side NLB, target group attachments via DNS A records, and endpoint service.
ops/modules/privatelink/provider/outputs.tf	Exposes endpoint service name and NLB ARN for consumers.
ops/modules/privatelink/consumer/variables.tf	Defines inputs for the consumer interface endpoint module.
ops/modules/privatelink/consumer/main.tf	Creates interface endpoint and associated security group rules.
ops/modules/privatelink/consumer/outputs.tf	Outputs endpoint DNS entries/id for application configuration.
ops/mainnet/staging/core/main.tf	Creates provider PrivateLink service for lighthouse queue Redis.
ops/mainnet/staging/core/outputs.tf	Exposes endpoint service name and Redis connection components via remote state.
ops/mainnet/staging/backend/main.tf	Creates the consumer interface endpoint in the backend VPC.
ops/mainnet/staging/backend/config.tf	Switches REDIS_URL to use the PrivateLink endpoint DNS with tlsServername.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.