fix(platform): close remaining audit findings from security review

Harden preview/deploy flows, OTP generation, zip extraction, and multi-replica billing races; document full remediation status in AUDIT-STATUS.fa.md.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/applications/entities/application.entity.ts

@@ -52,9 +52,16 @@ export class Application {
   @Column({ nullable: true })
   dbUsername: string;
 
+  /** Never expose raw DB password in API responses — use hasDbPassword for UI. */
+  @Exclude({ toPlainOnly: true })
   @Column({ nullable: true })
   dbPassword: string;
 
+  @Expose()
+  get hasDbPassword(): boolean {
+    return !!this.dbPassword;
+  }
+
   @Column({ nullable: true, default: '1Gi' })
   dbStorageSize: string; // PVC storage size for database (e.g. '1Gi', '5Gi', '10Gi')