feat(helm): add cloudhost-app Helm chart for all runtimes

- deployment.yaml with imagePullSecrets, health probes, WordPress volumes
- db-deployment.yaml for PostgreSQL/MySQL with readiness/liveness probes
- ingress.yaml with cert-manager TLS
- registry-pull-secret.yaml for insecure registries
- PVCs and secrets with helm.sh/resource-policy: keep
- _helpers.tpl with shared template functions
- values.yaml with comprehensive defaults

backend/helm/cloudhost-app/templates/_helpers.tpl

@@ -0,0 +1,81 @@
+{{/*
+CloudHost App — template helpers
+*/}}
+
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "cloudhost-app.name" -}}
+{{- .Values.app.name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Namespace for the release.
+*/}}
+{{- define "cloudhost-app.namespace" -}}
+{{- .Values.app.namespace }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "cloudhost-app.labels" -}}
+app: {{ include "cloudhost-app.name" . }}
+app.kubernetes.io/managed-by: cloudhost-helm
+runtime: {{ .Values.app.runtime }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "cloudhost-app.selectorLabels" -}}
+app: {{ include "cloudhost-app.name" . }}
+{{- end }}
+
+{{/*
+Database name (app name with dashes replaced by underscores)
+*/}}
+{{- define "cloudhost-app.dbName" -}}
+{{- .Values.app.name | replace "-" "_" }}
+{{- end }}
+
+{{/*
+Database deployment name
+*/}}
+{{- define "cloudhost-app.dbDeploymentName" -}}
+{{- printf "%s-db" .Values.app.name }}
+{{- end }}
+
+{{/*
+Database image — auto-computed from type + version if not explicitly set
+*/}}
+{{- define "cloudhost-app.dbImage" -}}
+{{- if .Values.database.image }}
+  {{- .Values.database.image }}
+{{- else if eq .Values.database.type "postgresql" }}
+  {{- printf "postgres:%s-alpine" .Values.database.version }}
+{{- else }}
+  {{- printf "mysql:%s" .Values.database.version }}
+{{- end }}
+{{- end }}
+
+{{/*
+Database port
+*/}}
+{{- define "cloudhost-app.dbPort" -}}
+{{- if eq .Values.database.type "postgresql" }}5432{{- else }}3306{{- end }}
+{{- end }}
+
+{{/*
+Database data mount path (volume mount target)
+*/}}
+{{- define "cloudhost-app.dbDataPath" -}}
+{{- if eq .Values.database.type "postgresql" }}/var/lib/postgresql/data{{- else }}/var/lib/mysql{{- end }}
+{{- end }}
+
+{{/*
+PostgreSQL PGDATA path — must be a subdirectory of the mount to avoid "initdb: directory not empty" errors
+*/}}
+{{- define "cloudhost-app.pgDataDir" -}}
+/var/lib/postgresql/data/pgdata
+{{- end }}