fix(platform): apply production hardening from audit plan

Close billing, tenancy, migration, build, and CI/CD gaps identified in the
audit: wallet/gateway guards, full-UUID namespaces, idempotent migrations with
base schema, stateful service stability, safer Dockerfiles/git builds, and
platform chart hardening (Redis auth, RollingUpdate, backups, Swagger off).

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/helm/cloudhost-platform/templates/migrations-job.yaml

@@ -7,7 +7,9 @@ metadata:
   labels:
     {{- include "cloudhost-platform.labels" . | nindent 4 }}
   annotations:
-    helm.sh/hook: post-install,post-upgrade
+    # Run BEFORE the backend rolls out so schema-dependent code never starts
+    # against an unmigrated database.
+    helm.sh/hook: pre-install,pre-upgrade
     helm.sh/hook-weight: "5"
     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
 spec:
@@ -47,9 +49,20 @@ spec:
             - -c
             - |
               set -e
+              # Track applied migrations so each file runs exactly once — the
+              # loop is idempotent across every helm upgrade.
+              psql -v ON_ERROR_STOP=1 -c "CREATE TABLE IF NOT EXISTS schema_migrations (filename TEXT PRIMARY KEY, applied_at TIMESTAMPTZ NOT NULL DEFAULT NOW());"
               for f in $(ls /migrations/*.sql | sort); do
-                echo ">>> Applying $f"
-                psql -v ON_ERROR_STOP=1 -f "$f"
+                name=$(basename "$f")
+                applied=$(psql -tA -c "SELECT 1 FROM schema_migrations WHERE filename = '$name';")
+                if [ "$applied" = "1" ]; then
+                  echo ">>> Skipping $name (already applied)"
+                  continue
+                fi
+                echo ">>> Applying $name"
+                psql -v ON_ERROR_STOP=1 --single-transaction \
+                  -f "$f" \
+                  -c "INSERT INTO schema_migrations (filename) VALUES ('$name');"
               done
               echo ">>> All migrations applied"
           volumeMounts: