refactor(redis): Migrate to ProjectionProvider and PrefixProvider.

Builds the secret resolution chain in newAuthnFormat by wrapping infra.Secrets in a PrefixProvider (mapping lookups under redis/) and a ProjectionProvider, stored on authenticatedFormat as a secret.Provider. resolveSecret now delegates to this provider keyed by JSON field name, and the per-field nil-projection plumbing in AuthConfig and Addrs is replaced by resolveConfigKey/resolveSecret calls against the new field-name constants (fieldAddrs, fieldUsername, and so on). resolveConfigKey lets an explicit value in the Redis config take precedence over the projected secret.

Moves validation up front: newAuthnFormat now resolves the projection and rejects a nil secret provider with ErrMissingSecrets at construction time, and wraps the nil-infra case with infrastructure.ErrNotConfigured. The projection method becomes a package function taking the config directly, since resolution no longer hangs off authenticatedFormat.

Adds ignoreProjectionMissing to strip secret.ErrProjectionMissing from the joined error, so optional projection fields that are unset no longer fail AuthConfig. The method now returns a zeroed authConfig on any remaining error rather than a partially populated one.

Updates the tests to construct formats via newAuthnFormat, assert error sentinels with errors.Is and types with reflect.Type, and compare configs with cmp.Diff, adding github.com/google/go-cmp. Constructor-time failure cases (nil secrets, unknown format, missing projection) move to Test_newAuthnFormat, and a case covering config-over-secret precedence is added.