feat(platform): wire OTP SMS env from platform Secret via Helm

Enable backend.sms in the chart so MizbanSMS credentials from the platform
Secret are injected into the backend deployment for production OTP delivery.

Co-authored-by: Cursor <cursoragent@cursor.com>

gitops/platform/values-abrban.example.yaml

@@ -112,6 +112,13 @@ backend:
     KIBANA_SYSTEM_PASSWORD: "CHANGE_VIA_SEALEDSECRET_OR_KUBECTL"
     # Swagger disabled in production unless explicitly enabled
     # SWAGGER_ENABLED: "true"
+  # OTP SMS — username/password in abrban-platform-secrets (SealedSecret).
+  sms:
+    enabled: true
+    provider: mizbansms
+    from: "5000467254"
+    api: "2016"
+    userType: "2"
 
 frontend:
   enabled: true

gitops/sealed-secrets/abrban-platform-secrets.example.yaml

@@ -4,7 +4,8 @@
 #
 # Required keys (must match backend Deployment + validate-production-config):
 #   postgres-password, jwt-secret, jwt-refresh-secret, cluster-kubeconfig-key,
-#   redis-password, elastic-password (must match elasticsearch-credentials in logging)
+#   redis-password, elastic-password (must match elasticsearch-credentials in logging),
+#   mizbansms-username, mizbansms-password (OTP SMS — required when backend.sms.enabled)
 #
 # Generate (replace CHANGE_ME_* with strong random values):
 #
@@ -15,6 +16,8 @@
 #     --from-literal=cluster-kubeconfig-key='0123456789abcdef0123456789abcdef' \
 #     --from-literal=redis-password='CHANGE_ME_REDIS' \
 #     --from-literal=elastic-password='CHANGE_ME_ELASTIC' \
+#     --from-literal=mizbansms-username='CHANGE_ME_SMS_USER' \
+#     --from-literal=mizbansms-password='CHANGE_ME_SMS_PASS' \
 #     --dry-run=client -o json \
 #   | kubeseal \
 #       --controller-name=sealed-secrets-controller \