fix(SEC-ORCH-28+29): Add Valkey connection timeout + workItems MaxLength

SEC-ORCH-28: Add connectTimeout (5000ms default) and commandTimeout
(3000ms default) to Valkey/Redis client to prevent indefinite connection
hangs. Both are configurable via VALKEY_CONNECT_TIMEOUT_MS and
VALKEY_COMMAND_TIMEOUT_MS environment variables.

SEC-ORCH-29: Add @ArrayMaxSize(50) and @MaxLength(2000) to workItems
in AgentContextDto to prevent memory exhaustion from unbounded input.
Also adds @ArrayMaxSize(20) and @MaxLength(200) to skills array.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/orchestrator/src/valkey/valkey.service.ts

@@ -23,6 +23,8 @@ export class ValkeyService implements OnModuleDestroy {
     const config: ValkeyClientConfig = {
       host: this.configService.get<string>("orchestrator.valkey.host", "localhost"),
       port: this.configService.get<number>("orchestrator.valkey.port", 6379),
+      connectTimeout: this.configService.get<number>("orchestrator.valkey.connectTimeout", 5000),
+      commandTimeout: this.configService.get<number>("orchestrator.valkey.commandTimeout", 3000),
       logger: {
         error: (message: string, error?: unknown) => {
           this.logger.error(message, error instanceof Error ? error.stack : String(error));