fix(platform): apply production hardening from audit plan

Close billing, tenancy, migration, build, and CI/CD gaps identified in the
audit: wallet/gateway guards, full-UUID namespaces, idempotent migrations with
base schema, stateful service stability, safer Dockerfiles/git builds, and
platform chart hardening (Redis auth, RollingUpdate, backups, Swagger off).

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/helm/cloudhost-app/templates/db-deployment.yaml

@@ -16,6 +16,10 @@ metadata:
     {{- include "cloudhost-app.labels" . | nindent 4 }}
 spec:
   replicas: 1
+  # RWO volume + single replica: recreate the old pod before starting the new
+  # one — a rolling update would deadlock on the attached PVC.
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: {{ $dbName }}
@@ -114,7 +118,7 @@ spec:
               command: ["healthcheck.sh", "--connect", "--innodb_initialized"]
             {{- else if eq .Values.database.type "mongodb" }}
             exec:
-              command: ["mongosh", "--eval", "db.adminCommand('ping')"]
+              command: ["sh", "-c", "mongosh --quiet -u \"$MONGO_INITDB_ROOT_USERNAME\" -p \"$MONGO_INITDB_ROOT_PASSWORD\" --eval \"db.adminCommand('ping')\""]
             {{- else }}
             exec:
               command: ["mysqladmin", "ping", "-h", "127.0.0.1"]
@@ -131,7 +135,7 @@ spec:
               command: ["healthcheck.sh", "--connect", "--innodb_initialized"]
             {{- else if eq .Values.database.type "mongodb" }}
             exec:
-              command: ["mongosh", "--eval", "db.adminCommand('ping')"]
+              command: ["sh", "-c", "mongosh --quiet -u \"$MONGO_INITDB_ROOT_USERNAME\" -p \"$MONGO_INITDB_ROOT_PASSWORD\" --eval \"db.adminCommand('ping')\""]
             {{- else }}
             exec:
               command: ["mysqladmin", "ping", "-h", "127.0.0.1"]