fix(platform): apply production hardening from audit plan

Close billing, tenancy, migration, build, and CI/CD gaps identified in the
audit: wallet/gateway guards, full-UUID namespaces, idempotent migrations with
base schema, stateful service stability, safer Dockerfiles/git builds, and
platform chart hardening (Redis auth, RollingUpdate, backups, Swagger off).

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/helm/cloudhost-platform/values.yaml

@@ -12,6 +12,9 @@ createNamespace: true
 global:
   storageClass: ""
 
+# For clusters without direct docker.io access, point these at your mirror,
+# e.g. registry.abrban.com/abrban/postgres:16-alpine, and set
+# postgres.imagePullSecrets / redis.imagePullSecrets accordingly.
 images:
   postgres: postgres:16-alpine
   redis: redis:7-alpine
@@ -32,12 +35,31 @@ postgres:
   # Leave empty to auto-generate on first install (stored in Secret)
   password: ""
   storage: 10Gi
-  resources: {}
+  # Needed when images.postgres points at a private mirror
+  imagePullSecrets: []
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: "2"
+      memory: 2Gi
 
 redis:
   enabled: true
   storage: 1Gi
-  resources: {}
+  # Leave empty to auto-generate on first install (stored in Secret as redis-password).
+  # With secrets.existingSecret, that Secret must also contain a redis-password key.
+  password: ""
+  # Needed when images.redis points at a private mirror
+  imagePullSecrets: []
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi
+    limits:
+      cpu: 500m
+      memory: 512Mi
 
 backend:
   enabled: true
@@ -49,7 +71,13 @@ backend:
   sourceStorage:
     enabled: false
     existingSecret: ceph-app-sources-credentials
-  resources: {}
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: "2"
+      memory: 2Gi
   extraEnv: {}
   env:
     NODE_ENV: production
@@ -73,7 +101,13 @@ frontend:
   replicas: 1
   imagePullSecrets:
     - name: registry-pull-secret
-  resources: {}
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: "1"
+      memory: 1Gi
 
 # JWT secrets — set in production (values-production.example.yaml)
 secrets:
@@ -117,6 +151,7 @@ monitoring:
 
 backups:
   postgres:
-    enabled: false
+    enabled: true
     schedule: "0 3 * * *"
     storageSize: 10Gi
+    retentionDays: 7