fix(platform): apply production hardening from audit plan

Close billing, tenancy, migration, build, and CI/CD gaps identified in the
audit: wallet/gateway guards, full-UUID namespaces, idempotent migrations with
base schema, stateful service stability, safer Dockerfiles/git builds, and
platform chart hardening (Redis auth, RollingUpdate, backups, Swagger off).

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitea/workflows/build-deploy.yaml

@@ -71,6 +71,63 @@ jobs:
           ENDSCRIPT
           chmod +x wait_for_job.sh
 
+      - name: Run backend tests (Job)
+        shell: sh
+        run: |
+          JOB_NAME="test-be-$(echo $IMAGE_TAG | tr '.:' '-' | cut -c1-50)"
+          cat <<ENDJOB | kubectl apply -f -
+          apiVersion: batch/v1
+          kind: Job
+          metadata:
+            name: ${JOB_NAME}
+            namespace: ${BUILD_NS}
+          spec:
+            ttlSecondsAfterFinished: 3600
+            backoffLimit: 0
+            template:
+              spec:
+                restartPolicy: Never
+                imagePullSecrets:
+                  - name: registry-pull-secret
+                containers:
+                  - name: test
+                    image: ${PULL_REGISTRY}/${PROJECT}/node:24-alpine
+                    envFrom:
+                      - secretRef:
+                          name: registry-egress-proxy
+                    command:
+                      - sh
+                      - -c
+                      - |
+                        apk add --no-cache git &&
+                        git clone --depth=1 --branch main http://oauth2:${GITEA_TOKEN}@${GITEA_HOST}/${REPO_PATH} /workspace &&
+                        cd /workspace/backend &&
+                        npm ci --legacy-peer-deps &&
+                        npm run test -- --ci --runInBand
+                    resources:
+                      requests: { cpu: 500m, memory: 1Gi }
+                      limits: { cpu: "2", memory: 3Gi }
+          ENDJOB
+          echo "Waiting for backend test job: ${JOB_NAME}"
+          # Reuse the waiter but read logs from the "test" container on failure
+          DEADLINE=$(( $(date +%s) + 1800 ))
+          while :; do
+            CONDS="$(kubectl -n ${BUILD_NS} get job/${JOB_NAME} -o jsonpath='{range .status.conditions[*]}{.type}={.status} {end}' 2>/dev/null)"
+            case "$CONDS" in
+              *Complete=True*) echo "Tests passed"; break ;;
+              *Failed=True*)
+                echo "Tests FAILED — logs:"
+                kubectl -n ${BUILD_NS} logs job/${JOB_NAME} -c test --tail=200 || true
+                exit 1 ;;
+            esac
+            if [ "$(date +%s)" -gt "$DEADLINE" ]; then
+              echo "Timed out waiting for tests — logs:"
+              kubectl -n ${BUILD_NS} logs job/${JOB_NAME} -c test --tail=200 || true
+              exit 1
+            fi
+            sleep 15
+          done
+
       - name: Build backend image (Kaniko Job)
         shell: sh
         run: |
@@ -219,5 +276,13 @@ jobs:
           git add "${VALUES}"
           if ! git diff --cached --quiet; then
             git commit -m "ci: deploy platform ${IMAGE_TAG}"
-            git push origin HEAD:main
+            # Retry with rebase — another pipeline may have pushed meanwhile.
+            for attempt in 1 2 3; do
+              if git push origin HEAD:main; then
+                break
+              fi
+              echo "Push rejected (attempt ${attempt}) — rebasing on latest main"
+              git pull --rebase origin main
+              [ "$attempt" = "3" ] && { echo "Giving up after 3 attempts"; exit 1; }
+            done
           fi