Harden platform security, reliability, and CI after full audit.

Close deployment IDOR and gate stub payment endpoints, add production
secret validation, health probes, Redis-backed build progress, GitHub
Actions CI, expanded tests, billing/k8s refactors, and ops runbooks.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/build/build.service.ts

@@ -10,6 +10,7 @@ import { Application } from '../applications/entities/application.entity';
 import { AppRuntime } from '../common/enums';
 import { ClustersService } from '../clusters/clusters.service';
 import { RegistryService } from '../kubernetes/registry.service';
+import { BuildProgressStore } from './build-progress.store';
 
 const execFileAsync = promisify(execFile);
 
@@ -55,6 +56,7 @@ export class BuildService {
     private configService: ConfigService,
     private clustersService: ClustersService,
     private registryService: RegistryService,
+    private progressStore: BuildProgressStore,
   ) {}
 
   private beginBuildSession(deploymentId: string): void {
@@ -277,17 +279,23 @@ export class BuildService {
     this.logger.log(`Cleaned up all build resources matching "${prefix}*" in ${buildNamespace}`);
   }
 
-  getProgress(deploymentId: string): BuildProgress | null {
-    return this.progressMap.get(deploymentId) ?? null;
+  async getProgress(deploymentId: string): Promise<BuildProgress | null> {
+    const local = this.progressMap.get(deploymentId);
+    if (local) return local;
+    const remote = await this.progressStore.get(deploymentId);
+    if (remote) this.progressMap.set(deploymentId, remote);
+    return remote;
   }
 
   setProgress(deploymentId: string | undefined, progress: BuildProgress): void {
     if (!deploymentId) return;
     this.progressMap.set(deploymentId, progress);
+    void this.progressStore.set(deploymentId, progress);
   }
 
   clearProgress(deploymentId: string): void {
     this.progressMap.delete(deploymentId);
+    void this.progressStore.clear(deploymentId);
   }
 
   /**