Problem

`MCPServer.spec.sessionStorage.passwordRef` is accepted by the CRD schema, and the runner reads `THV_SESSION_REDIS_PASSWORD` (see `pkg/transport/session/redis_config.go`), but the operator never wires the two together. `populateScalingConfig` in `cmd/thv-operator/controllers/mcpserver_runconfig.go` copies only `Address`/`DB`/`KeyPrefix` into RunConfig, and no env var is appended to the proxy runner container.

Result: any `MCPServer` pointed at a password-protected Redis fails on startup with:

```
{"level":"ERROR","msg":"error executing command","error":"failed to create Redis session storage: failed to connect to redis: NOAUTH Authentication required."}
```

reproducible at v0.27.2 and on `main` as of this PR's base.

Why this was missing

PR #4368 (which introduced MCPServer runconfig wiring) explicitly noted:

the Redis password is intentionally excluded and injected as a pod env var instead

The env-var injection then landed for `VirtualMCPServer` in #4215 via `buildRedisPasswordEnvVar` — but the parallel MCPServer change wasn't made. From the user's side, the field looks supported (CRD validation passes, runner accepts the value) but silently no-ops at runtime.

Fix

Mirror the VirtualMCPServer pattern:

1. `mcpserver_controller.go` — new helper `buildMCPServerRedisPasswordEnvVar` that returns `[]corev1.EnvVar` with a single `SecretKeyRef`-backed `THV_SESSION_REDIS_PASSWORD` entry when `sessionStorage.provider == "redis"` and `passwordRef` is set; returns `nil` otherwise.
2. Append its output to the proxy container's env slice in the MCPServer reconciler, immediately before `resourceOverrides.proxyDeployment.env` so user-supplied overrides still win on name collisions.
3. `mcpserver_replicas_test.go` — add `TestBuildMCPServerRedisPasswordEnvVar` mirroring `TestBuildRedisPasswordEnvVar` for VirtualMCPServer (nil storage, memory provider, redis without passwordRef, redis with passwordRef).

Scope

• No CRD changes — the schema already supports `passwordRef`.
• No behavior change when `passwordRef` is unset — the helper returns `nil` and no env var is added.
• Identical secret-mounting semantics to the VirtualMCPServer path, so security-review notes from Extend deploymentForVirtualMCPServer with spec-driven replicas, terminationGracePeriodSeconds, and Redis password env var #4215 carry over.

Test plan

• `go build ./cmd/thv-operator/...`
• `go test -count=1 ./cmd/thv-operator/controllers/` — all green (3.7s)
• New `TestBuildMCPServerRedisPasswordEnvVar` covers four cases (nil, memory, redis-no-passwordRef, redis-with-passwordRef) and asserts the env var uses `SecretKeyRef` (no plaintext `Value`).
• Integration verification: deployed locally against an MCPServer running with `replicas: 2` against a password-protected Redis; proxy connects cleanly.

Related

• Inject BackendReplicas and Redis session config into MCPServer RunConfig #4368 — MCPServer runconfig wiring (deferred password env var)
• Extend deploymentForVirtualMCPServer with spec-driven replicas, terminationGracePeriodSeconds, and Redis password env var #4215 — VirtualMCPServer Redis password env var (precedent for this PR's pattern)
• Extend MCPServer reconciler and deployment builder with spec-driven replicas, stdio cap, session storage validation, and terminationGracePeriodSeconds #4217 — MCPServer reconciler/builder scaling support (out-of-scope sister)