Fix Kaniko registry auth and push target for Harbor builds.

Mount docker config as config.json (Kaniko requirement), push via
harbor-registry internal URL, and wire harbor_registry_user credentials
in Helm/GitOps values.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/helm/cloudhost-platform/templates/backend-deployment.yaml

@@ -125,6 +125,15 @@ spec:
                   name: {{ include "cloudhost-platform.secretName" . }}
                   key: mizbansms-password
             {{- end }}
+            {{- if .Values.registry.credentialsSecret }}
+            - name: REGISTRY_USERNAME
+              value: {{ .Values.registry.username | default "harbor_registry_user" | quote }}
+            - name: REGISTRY_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.registry.credentialsSecret | quote }}
+                  key: {{ .Values.registry.credentialsPasswordKey | default "REGISTRY_CREDENTIAL_PASSWORD" | quote }}
+            {{- end }}
             {{- include "cloudhost-platform.buildEnv" . | nindent 12 }}
             {{- range $key, $val := .Values.backend.env }}
             - name: {{ $key }}

backend/helm/cloudhost-platform/values.yaml

@@ -28,6 +28,12 @@ images:
     tag: "1.0.0"
     pullPolicy: IfNotPresent
 
+# Kaniko push credentials — harbor_registry_user for harbor-registry:5000 (Harbor production).
+registry:
+  credentialsSecret: ""
+  credentialsPasswordKey: REGISTRY_CREDENTIAL_PASSWORD
+  username: harbor_registry_user
+
 # Kaniko job images — defaults pull from Harbor proxy-cache.
 # Override any line for a different registry/tag.
 build: