fix(platform): apply production hardening from audit plan

Close billing, tenancy, migration, build, and CI/CD gaps identified in the
audit: wallet/gateway guards, full-UUID namespaces, idempotent migrations with
base schema, stateful service stability, safer Dockerfiles/git builds, and
platform chart hardening (Redis auth, RollingUpdate, backups, Swagger off).

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/applications/entities/application.entity.ts

@@ -16,6 +16,7 @@ import {
   CustomDomainStatus,
   ProductType,
 } from '../../common/enums';
+import { Exclude, Expose } from 'class-transformer';
 import { User } from '../../users/entities/user.entity';
 import { Deployment } from '../../deployments/entities/deployment.entity';
 
@@ -111,8 +112,19 @@ export class Application {
   @Column({ nullable: true })
   gitUrl: string;
 
+  /**
+   * Personal access token for private repos. Never serialized into API
+   * responses (see hasGitToken) — it is a credential to an external system.
+   */
+  @Exclude({ toPlainOnly: true })
   @Column({ nullable: true })
-  gitToken: string; // Personal access token for private repos
+  gitToken: string;
+
+  /** Whether a git token is configured (safe indicator for the UI). */
+  @Expose()
+  get hasGitToken(): boolean {
+    return !!this.gitToken;
+  }
 
   @Column({ nullable: true })
   gitBranch: string; // Branch to clone (default: main)