Harden platform security, reliability, and CI after full audit.

Close deployment IDOR and gate stub payment endpoints, add production
secret validation, health probes, Redis-backed build progress, GitHub
Actions CI, expanded tests, billing/k8s refactors, and ops runbooks.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/helm/cloudhost-platform/templates/monitoring.yaml

@@ -0,0 +1,35 @@
+{{- if .Values.monitoring.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "cloudhost-platform.fullname" . }}-backend-metrics
+  namespace: {{ include "cloudhost-platform.namespace" . }}
+  labels:
+    {{- include "cloudhost-platform.labels" . | nindent 4 }}
+    app.kubernetes.io/component: backend
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 4000
+      targetPort: 4000
+  selector:
+    app: {{ include "cloudhost-platform.backend.fullname" . }}
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ include "cloudhost-platform.fullname" . }}-backend
+  namespace: {{ include "cloudhost-platform.namespace" . }}
+  labels:
+    {{- include "cloudhost-platform.labels" . | nindent 4 }}
+    release: prometheus
+spec:
+  selector:
+    matchLabels:
+      app: {{ include "cloudhost-platform.backend.fullname" . }}
+  endpoints:
+    - port: http
+      path: /api/v1/health
+      interval: 30s
+{{- end }}