Harden platform security, reliability, and CI after full audit.

Close deployment IDOR and gate stub payment endpoints, add production
secret validation, health probes, Redis-backed build progress, GitHub
Actions CI, expanded tests, billing/k8s refactors, and ops runbooks.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/config/configuration.ts

@@ -84,6 +84,11 @@ export default () => ({
     port: parseInt(process.env.REDIS_PORT || '6379', 10),
   },
 
+  cluster: {
+    /** AES-256-GCM key for encrypting stored kubeconfigs. Required in production. */
+    kubeconfigKey: process.env.CLUSTER_KUBECONFIG_KEY || '',
+  },
+
   // OTP SMS. Provider selectable via SMS_PROVIDER ('mizbansms' | 'kavenegar').
   sms: {
     provider: (process.env.SMS_PROVIDER || 'mizbansms').trim().toLowerCase(),