fix(platform): apply production hardening from audit plan

Close billing, tenancy, migration, build, and CI/CD gaps identified in the
audit: wallet/gateway guards, full-UUID namespaces, idempotent migrations with
base schema, stateful service stability, safer Dockerfiles/git builds, and
platform chart hardening (Redis auth, RollingUpdate, backups, Swagger off).

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/generate-audit-pdf.mjs

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+import puppeteer from 'puppeteer-core';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const root = path.resolve(__dirname, '..');
+
+const htmlPath = path.join(__dirname, 'audit-report.fa.html');
+const pdfPath = path.join(root, 'AUDIT-REPORT.fa.pdf');
+
+const chromePaths = [
+  '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
+  '/Applications/Chromium.app/Contents/MacOS/Chromium',
+  '/usr/bin/google-chrome',
+  '/usr/bin/chromium',
+];
+
+const executablePath = process.env.CHROME_PATH || chromePaths.find((p) => fs.existsSync(p));
+
+if (!executablePath) {
+  console.error('Chrome/Chromium not found. Install Google Chrome or set CHROME_PATH.');
+  process.exit(1);
+}
+
+const browser = await puppeteer.launch({
+  executablePath,
+  headless: true,
+  args: ['--no-sandbox', '--disable-setuid-sandbox'],
+});
+const page = await browser.newPage();
+await page.goto(`file://${htmlPath}`, { waitUntil: 'networkidle0' });
+await page.pdf({
+  path: pdfPath,
+  format: 'A4',
+  printBackground: true,
+  margin: { top: '14mm', right: '13mm', bottom: '14mm', left: '13mm' },
+});
+await browser.close();
+console.log(`Created: ${pdfPath}`);