Harden platform security, reliability, and CI after full audit.

Close deployment IDOR and gate stub payment endpoints, add production
secret validation, health probes, Redis-backed build progress, GitHub
Actions CI, expanded tests, billing/k8s refactors, and ops runbooks.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/billing/payment-gateway.util.ts

@@ -0,0 +1,14 @@
+import { ForbiddenException } from '@nestjs/common';
+
+/**
+ * Stub gateway endpoints auto-approve payments without a real provider.
+ * Disabled in production unless PAYMENT_GATEWAY_STUB_ENABLED=true (staging only).
+ */
+export function assertStubGatewayAllowed(): void {
+  if (
+    process.env.NODE_ENV === 'production' &&
+    process.env.PAYMENT_GATEWAY_STUB_ENABLED !== 'true'
+  ) {
+    throw new ForbiddenException('Payment gateway is not configured');
+  }
+}