feat(helm): add cloudhost-app Helm chart for all runtimes

- deployment.yaml with imagePullSecrets, health probes, WordPress volumes
- db-deployment.yaml for PostgreSQL/MySQL with readiness/liveness probes
- ingress.yaml with cert-manager TLS
- registry-pull-secret.yaml for insecure registries
- PVCs and secrets with helm.sh/resource-policy: keep
- _helpers.tpl with shared template functions
- values.yaml with comprehensive defaults

backend/helm/cloudhost-app/templates/ingress.yaml

@@ -0,0 +1,31 @@
+{{- if .Values.ingress.enabled }}
+{{- $name := include "cloudhost-app.name" . -}}
+{{- $ns   := include "cloudhost-app.namespace" . -}}
+{{- $host := printf "%s.%s" (default $name .Values.ingress.subdomain) .Values.ingress.domain -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ $name }}
+  namespace: {{ $ns }}
+  labels:
+    {{- include "cloudhost-app.labels" . | nindent 4 }}
+  annotations:
+    cert-manager.io/cluster-issuer: {{ .Values.ingress.clusterIssuer | quote }}
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: {{ $host }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ $name }}
+                port:
+                  number: 80
+  tls:
+    - hosts:
+        - {{ $host }}
+      secretName: {{ $name }}-tls
+{{- end }}