fix(platform): apply production hardening from audit plan

Close billing, tenancy, migration, build, and CI/CD gaps identified in the
audit: wallet/gateway guards, full-UUID namespaces, idempotent migrations with
base schema, stateful service stability, safer Dockerfiles/git builds, and
platform chart hardening (Redis auth, RollingUpdate, backups, Swagger off).

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/k8s/logging/elasticsearch-stack.yaml

@@ -9,18 +9,16 @@ metadata:
   labels:
     app.kubernetes.io/managed-by: cloudhost
 ---
-# Elasticsearch credentials secret
-apiVersion: v1
-kind: Secret
-metadata:
-  name: elasticsearch-credentials
-  namespace: logging
-type: Opaque
-stringData:
-  # Admin credentials - change in production!
-  ELASTIC_PASSWORD: "CloudHost2024!Secure"
-  # For Fluent Bit to send logs
-  FLUENTBIT_PASSWORD: "FluentBit2024!Writer"
+# Elasticsearch credentials — managed OUT-OF-BAND, never committed to git.
+# Create the Secret before applying this manifest (or use a SealedSecret in
+# the GitOps repo):
+#
+#   kubectl -n logging create secret generic elasticsearch-credentials \
+#     --from-literal=ELASTIC_PASSWORD="$(openssl rand -base64 24)" \
+#     --from-literal=FLUENTBIT_PASSWORD="$(openssl rand -base64 24)"
+#
+# The backend reads the same values from ELASTIC_PASSWORD / FLUENTBIT_PASSWORD
+# env vars (see cloudhost-platform values: backend.extraEnv or an extra Secret).
 ---
 # ConfigMap for Elasticsearch configuration
 apiVersion: v1