feat(build): revamp app build pipeline (queue, Nixpacks, MinIO, Trivy, registry GC)

Rework the application build/deploy pipeline for scalability, reproducibility,
and security:

- Build queue: deploys run through a bounded-concurrency Bull queue
  (BUILD_CONCURRENCY, default 3) so concurrent user deploys can't flood the
  cluster with Kaniko jobs. Build state (progress / cancel / session) moves from
  in-memory Maps to Redis, so cancel + live logs work across backend replicas.
- Nixpacks + BYO Dockerfile: code runtimes build via Nixpacks (or the user's own
  Dockerfile when present); the hand-written per-runtime Dockerfile generators
  and runtime auto-detection are removed. WordPress keeps its templated path.
  Build-time mirror env (NIXPACKS_BUILD_ENV) supports the Iran network.
- Source upload to MinIO: archives stream to in-cluster MinIO; build pods pull
  via a presigned URL. Removes the PVC + helper pod + kubectl cp upload path.
- Report-only Trivy scan after build; per-severity summary stored on the
  deployment and shown as a badge in the dashboard. Never gates a deploy.
- Registry GC: a Redis-locked daily job keeps the newest N image tags per app
  (REGISTRY_KEEP_VERSIONS, default 3) and reclaims disk via garbage-collect.
- Hardening: git tokens are delivered via a per-build Secret + git credential
  store instead of being embedded in the clone URL / Job manifest; build timeout
  is configurable.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/common/redis/redis.module.ts

@@ -0,0 +1,51 @@
+import { Global, Module, OnApplicationShutdown, Logger } from '@nestjs/common';
+import { ModuleRef } from '@nestjs/core';
+import { ConfigService } from '@nestjs/config';
+import IORedis, { Redis } from 'ioredis';
+
+/** Injection token for the shared ioredis client. */
+export const REDIS_CLIENT = 'REDIS_CLIENT';
+
+/**
+ * Shared Redis client used for build state (progress / cancel flags / build
+ * sessions) so the data survives across backend replicas — unlike the previous
+ * in-memory Maps that only worked with a single instance.
+ *
+ * Reuses the same connection details as the Bull queue (`redis.host/port`).
+ */
+@Global()
+@Module({
+  providers: [
+    {
+      provide: REDIS_CLIENT,
+      inject: [ConfigService],
+      useFactory: (configService: ConfigService): Redis => {
+        const client = new IORedis({
+          host: configService.get<string>('redis.host'),
+          port: configService.get<number>('redis.port'),
+          // Build state writes are best-effort telemetry — never let a Redis
+          // hiccup take down the request that triggered them.
+          maxRetriesPerRequest: 2,
+          enableOfflineQueue: true,
+        });
+        client.on('error', (err) => {
+          new Logger('RedisClient').warn(`Redis connection error: ${err.message}`);
+        });
+        return client;
+      },
+    },
+  ],
+  exports: [REDIS_CLIENT],
+})
+export class RedisModule implements OnApplicationShutdown {
+  constructor(private readonly moduleRef: ModuleRef) {}
+
+  async onApplicationShutdown(): Promise<void> {
+    try {
+      const client = this.moduleRef.get<Redis>(REDIS_CLIENT, { strict: false });
+      await client?.quit();
+    } catch {
+      /* ignore shutdown errors */
+    }
+  }
+}

backend/src/common/storage/storage.module.ts

@@ -0,0 +1,13 @@
+import { Global, Module } from '@nestjs/common';
+import { StorageService } from './storage.service';
+
+/**
+ * Global module exposing the MinIO-backed {@link StorageService} so both the API
+ * (source upload) and the build pipeline (presigned download) can inject it.
+ */
+@Global()
+@Module({
+  providers: [StorageService],
+  exports: [StorageService],
+})
+export class StorageModule {}

backend/src/common/storage/storage.service.ts

@@ -0,0 +1,64 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import * as Minio from 'minio';
+
+/**
+ * Object storage for application source archives, backed by the in-cluster MinIO
+ * (S3-compatible). Replaces the previous local-disk + PVC + kubectl-cp upload path:
+ * the API streams the uploaded zip straight to MinIO, and build pods pull it via a
+ * short-lived presigned URL (no credentials, no kubectl, no helper pod).
+ */
+@Injectable()
+export class StorageService {
+  private readonly logger = new Logger(StorageService.name);
+  private readonly client: Minio.Client;
+  private readonly bucket: string;
+  private bucketReady = false;
+
+  constructor(private readonly configService: ConfigService) {
+    this.bucket = this.configService.get<string>('minio.bucket') || 'app-sources';
+    this.client = new Minio.Client({
+      endPoint: this.configService.get<string>('minio.endpoint') || 'minio.cloudhost-builds.svc.cluster.local',
+      port: this.configService.get<number>('minio.port') || 9000,
+      useSSL: this.configService.get<boolean>('minio.useSSL') || false,
+      accessKey: this.configService.get<string>('minio.accessKey') || 'cloudhost',
+      secretKey: this.configService.get<string>('minio.secretKey') || '',
+    });
+  }
+
+  /** Object key for an app's source archive. */
+  sourceKey(userId: string, appId: string): string {
+    return `${userId}/${appId}/source.zip`;
+  }
+
+  private async ensureBucket(): Promise<void> {
+    if (this.bucketReady) return;
+    const exists = await this.client.bucketExists(this.bucket).catch(() => false);
+    if (!exists) {
+      await this.client.makeBucket(this.bucket);
+      this.logger.log(`Created MinIO bucket "${this.bucket}"`);
+    }
+    this.bucketReady = true;
+  }
+
+  /** Upload an app's source archive; returns the stored object key (saved as app.codePath). */
+  async putSource(userId: string, appId: string, data: Buffer): Promise<string> {
+    await this.ensureBucket();
+    const key = this.sourceKey(userId, appId);
+    await this.client.putObject(this.bucket, key, data, data.length, { 'Content-Type': 'application/zip' });
+    this.logger.log(`Uploaded source ${(data.length / 1024 / 1024).toFixed(1)}MB → ${this.bucket}/${key}`);
+    return key;
+  }
+
+  /** Short-lived presigned GET URL the build pod uses to download the source. */
+  async presignSourceGet(key: string, expirySeconds = 3600): Promise<string> {
+    return this.client.presignedGetObject(this.bucket, key, expirySeconds);
+  }
+
+  /** Best-effort delete of an app's source object (e.g. on app deletion). */
+  async removeSource(key: string): Promise<void> {
+    await this.client.removeObject(this.bucket, key).catch((e) => {
+      this.logger.warn(`Failed to remove source ${key}: ${e.message}`);
+    });
+  }
+}