fix(platform): apply production hardening from audit plan

Close billing, tenancy, migration, build, and CI/CD gaps identified in the
audit: wallet/gateway guards, full-UUID namespaces, idempotent migrations with
base schema, stateful service stability, safer Dockerfiles/git builds, and
platform chart hardening (Redis auth, RollingUpdate, backups, Swagger off).

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/config/configuration.ts

@@ -82,6 +82,7 @@ export default () => ({
   redis: {
     host: process.env.REDIS_HOST || 'localhost',
     port: parseInt(process.env.REDIS_PORT || '6379', 10),
+    password: process.env.REDIS_PASSWORD || undefined,
   },
 
   cluster: {
@@ -133,6 +134,20 @@ export default () => ({
   build: {
     namespace: process.env.BUILD_NAMESPACE || 'cloudhost-builds',
     serviceAccount: process.env.BUILD_SERVICE_ACCOUNT || 'kaniko-builder',
+    /**
+     * Optional registry prefix for Docker Hub base images used in generated
+     * Dockerfiles and managed-service charts (e.g. "mirror.example.com" makes
+     * `node:20-alpine` → `mirror.example.com/node:20-alpine`). Useful when
+     * cluster nodes cannot reach docker.io directly.
+     */
+    baseImageRegistry: (process.env.BASE_IMAGE_REGISTRY || '').trim().replace(/\/+$/, ''),
+    /** Kaniko build container resources — tune for large images. */
+    kaniko: {
+      cpuRequest: process.env.KANIKO_CPU_REQUEST || '500m',
+      cpuLimit: process.env.KANIKO_CPU_LIMIT || '2',
+      memoryRequest: process.env.KANIKO_MEMORY_REQUEST || '1Gi',
+      memoryLimit: process.env.KANIKO_MEMORY_LIMIT || '4Gi',
+    },
   },
 
   elasticsearch: {