fix(platform): apply production hardening from audit plan

Close billing, tenancy, migration, build, and CI/CD gaps identified in the
audit: wallet/gateway guards, full-UUID namespaces, idempotent migrations with
base schema, stateful service stability, safer Dockerfiles/git builds, and
platform chart hardening (Redis auth, RollingUpdate, backups, Swagger off).

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/helm/cloudhost-app/templates/redis-deployment.yaml

@@ -2,11 +2,21 @@
 {{- $name    := include "cloudhost-app.name" . -}}
 {{- $ns      := include "cloudhost-app.namespace" . -}}
 {{- $redisName := printf "%s-redis" $name -}}
+{{- /* Preserve the existing password across upgrades — regenerating it every
+       upgrade would break app↔Redis auth against the persisted volume. */ -}}
+{{- $redisSecretName := printf "%s-secret" $redisName -}}
+{{- $existingRedis := lookup "v1" "Secret" $ns $redisSecretName -}}
+{{- $redisPass := "" -}}
+{{- if and $existingRedis $existingRedis.data (index $existingRedis.data "password") -}}
+{{- $redisPass = index $existingRedis.data "password" | b64dec -}}
+{{- else -}}
+{{- $redisPass = randAlphaNum 16 -}}
+{{- end -}}
 ---
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ $redisName }}-secret
+  name: {{ $redisSecretName }}
   namespace: {{ $ns }}
   labels:
     app: {{ $redisName }}
@@ -15,7 +25,7 @@ metadata:
     "helm.sh/resource-policy": keep
 type: Opaque
 data:
-  password: {{ randAlphaNum 16 | b64enc | quote }}
+  password: {{ $redisPass | b64enc | quote }}
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
@@ -47,6 +57,10 @@ metadata:
     {{- include "cloudhost-app.labels" . | nindent 4 }}
 spec:
   replicas: 1
+  # RWO volume + single replica: recreate the old pod before starting the new
+  # one, otherwise a rolling update deadlocks on the attached PVC.
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: {{ $redisName }}
@@ -57,7 +71,7 @@ spec:
     spec:
       containers:
         - name: redis
-          image: {{ printf "redis:%s-alpine" (.Values.redis.version | default "7.2") }}
+          image: {{ include "cloudhost-app.baseImage" (dict "root" $ "image" (printf "redis:%s-alpine" (.Values.redis.version | default "7.2"))) }}
           args: ["--requirepass", "$(REDIS_PASSWORD)"]
           ports:
             - containerPort: 6379
@@ -65,7 +79,14 @@ spec:
             - name: REDIS_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: {{ $redisName }}-secret
+                  name: {{ $redisSecretName }}
+                  key: password
+            # redis-cli in the probes auto-authenticates from REDISCLI_AUTH,
+            # so `redis-cli ping` works even with --requirepass set.
+            - name: REDISCLI_AUTH
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $redisSecretName }}
                   key: password
           volumeMounts:
             - name: redis-data