fix(chart): support existingSecret and provide CLUSTER_KUBECONFIG_KEY to backend

Backend now fails production validation without CLUSTER_KUBECONFIG_KEY.
Add cluster-kubeconfig-key to the chart secret and env, plus
secrets.existingSecret so GitOps deployments can use a pre-created
(sealed) Secret instead of the lookup/randAlphaNum template that churns
under Argo CD's helm template rendering.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/helm/cloudhost-platform/templates/_helpers.tpl

@@ -46,8 +46,12 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
 
 {{- define "cloudhost-platform.secretName" -}}
+{{- if .Values.secrets.existingSecret }}
+{{- .Values.secrets.existingSecret }}
+{{- else }}
 {{- printf "%s-secrets" (include "cloudhost-platform.fullname" .) }}
 {{- end }}
+{{- end }}
 
 {{- define "cloudhost-platform.tlsSecretName" -}}
 {{- if .Values.ingress.tls.secretName }}