fix(chart): support existingSecret and provide CLUSTER_KUBECONFIG_KEY to backend

Backend now fails production validation without CLUSTER_KUBECONFIG_KEY.
Add cluster-kubeconfig-key to the chart secret and env, plus
secrets.existingSecret so GitOps deployments can use a pre-created
(sealed) Secret instead of the lookup/randAlphaNum template that churns
under Argo CD's helm template rendering.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/helm/cloudhost-platform/values.yaml

@@ -77,8 +77,15 @@ frontend:
 
 # JWT secrets — set in production (values-production.example.yaml)
 secrets:
+  # Use a pre-created Secret instead of chart-managed one. Required for GitOps
+  # (Argo CD renders with `helm template`, so lookup/randAlphaNum regenerate on
+  # every sync). Secret must contain keys: postgres-password, jwt-secret,
+  # jwt-refresh-secret, cluster-kubeconfig-key.
+  existingSecret: ""
   jwtSecret: ""
   jwtRefreshSecret: ""
+  # AES key for encrypting stored kubeconfigs (64 hex chars or any passphrase)
+  clusterKubeconfigKey: ""
 
 ingress:
   enabled: true