fix(platform): apply production hardening from audit plan

Close billing, tenancy, migration, build, and CI/CD gaps identified in the
audit: wallet/gateway guards, full-UUID namespaces, idempotent migrations with
base schema, stateful service stability, safer Dockerfiles/git builds, and
platform chart hardening (Redis auth, RollingUpdate, backups, Swagger off).

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/helm/cloudhost-platform/values-production.example.yaml

@@ -8,6 +8,11 @@ global:
   storageClass: local-path   # k3s example
 
 images:
+  # Mirror Docker Hub images through your private registry so cluster nodes
+  # never pull from docker.io directly (matches the kaniko/Harbor setup).
+  postgres: registry.example.com/mirror/postgres:16-alpine
+  redis: registry.example.com/mirror/redis:7-alpine
+  busybox: registry.example.com/mirror/busybox:1.36
   backend:
     repository: registry.example.com/cloudhost-backend
     tag: "1.0.0"
@@ -19,6 +24,15 @@ images:
 
 postgres:
   password: "CHANGE_ME_STRONG_POSTGRES_PASSWORD"
+  # Pull secret for the mirrored postgres image
+  imagePullSecrets:
+    - name: registry-pull-secret
+
+redis:
+  # Auto-generated and persisted in the platform Secret when left empty.
+  password: ""
+  imagePullSecrets:
+    - name: registry-pull-secret
 
 secrets:
   jwtSecret: "CHANGE_ME_LONG_JWT_SECRET"
@@ -44,6 +58,20 @@ backend:
     PLATFORM_DOMAIN: apps.example.com
     REGISTRY_URL: registry.cloudhost-builds.svc.cluster.local:5000
     REGISTRY_PULL_URL: registry.cloudhost-builds.svc.cluster.local:5000
+    # Mirror prefix for base images in generated Dockerfiles + managed services
+    BASE_IMAGE_REGISTRY: registry.example.com/mirror
+    # Elastic log-stack credentials (must match the logging namespace Secret)
+    ELASTIC_PASSWORD: "CHANGE_ME_ELASTIC_PASSWORD"
+    FLUENTBIT_PASSWORD: "CHANGE_ME_FLUENTBIT_PASSWORD"
+    KIBANA_SYSTEM_PASSWORD: "CHANGE_ME_KIBANA_PASSWORD"
+    # Swagger stays off in production; set SWAGGER_ENABLED: "true" to expose it
 
 migrations:
   enabled: true
+
+backups:
+  postgres:
+    enabled: true
+    schedule: "0 3 * * *"
+    storageSize: 10Gi
+    retentionDays: 7