Harden platform security, reliability, and CI after full audit.

Close deployment IDOR and gate stub payment endpoints, add production
secret validation, health probes, Redis-backed build progress, GitHub
Actions CI, expanded tests, billing/k8s refactors, and ops runbooks.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/.env.example

@@ -20,6 +20,13 @@ JWT_REFRESH_EXPIRES_IN=7d
 REDIS_HOST=localhost
 REDIS_PORT=6379
 
+# Multi-cluster: AES-256-GCM key for encrypting kubeconfigs at rest (required in production).
+# Generate with: openssl rand -hex 32
+CLUSTER_KUBECONFIG_KEY=
+
+# Stub payment gateway (dev/staging only — disabled in production unless explicitly enabled)
+# PAYMENT_GATEWAY_STUB_ENABLED=true
+
 # ─── OTP SMS ────────────────────────────────────────────────────────────────
 # Pick the provider. Without valid credentials, OTP codes are logged to the API
 # console in development only; in production a missing config makes OTP send fail