fix(platform): apply production hardening from audit plan

Close billing, tenancy, migration, build, and CI/CD gaps identified in the
audit: wallet/gateway guards, full-UUID namespaces, idempotent migrations with
base schema, stateful service stability, safer Dockerfiles/git builds, and
platform chart hardening (Redis auth, RollingUpdate, backups, Swagger off).

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/helm/cloudhost-platform/migrations/001_service_access_grants.sql

@@ -1,16 +1,20 @@
 -- Temporary external access grants (Redis, RabbitMQ, database)
-CREATE TYPE service_access_target AS ENUM (
-  'database',
-  'redis',
-  'rabbitmq_amqp',
-  'rabbitmq_management'
-);
+DO $$ BEGIN
+  CREATE TYPE service_access_target AS ENUM (
+    'database',
+    'redis',
+    'rabbitmq_amqp',
+    'rabbitmq_management'
+  );
+EXCEPTION WHEN duplicate_object THEN null; END $$;
 
-CREATE TYPE service_access_grant_status AS ENUM (
-  'active',
-  'expired',
-  'revoked'
-);
+DO $$ BEGIN
+  CREATE TYPE service_access_grant_status AS ENUM (
+    'active',
+    'expired',
+    'revoked'
+  );
+EXCEPTION WHEN duplicate_object THEN null; END $$;
 
 CREATE TABLE IF NOT EXISTS service_access_grants (
   id UUID PRIMARY KEY DEFAULT gen_random_uuid(),