Harden platform security, reliability, and CI after full audit.

Close deployment IDOR and gate stub payment endpoints, add production
secret validation, health probes, Redis-backed build progress, GitHub
Actions CI, expanded tests, billing/k8s refactors, and ops runbooks.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/config/validate-production-config.ts

@@ -0,0 +1,34 @@
+const DEFAULT_JWT_SECRET = 'default-jwt-secret';
+const DEFAULT_REFRESH_SECRET = 'default-refresh-secret';
+const DEFAULT_DB_PASSWORD = 'cloudhost_secret';
+
+export function validateProductionConfig(): void {
+  if (process.env.NODE_ENV !== 'production') {
+    return;
+  }
+
+  const errors: string[] = [];
+
+  const jwtSecret = process.env.JWT_SECRET || DEFAULT_JWT_SECRET;
+  const refreshSecret = process.env.JWT_REFRESH_SECRET || DEFAULT_REFRESH_SECRET;
+  const dbPassword = process.env.DB_PASSWORD || DEFAULT_DB_PASSWORD;
+
+  if (!process.env.JWT_SECRET || jwtSecret === DEFAULT_JWT_SECRET) {
+    errors.push('JWT_SECRET must be set to a strong random value in production');
+  }
+  if (!process.env.JWT_REFRESH_SECRET || refreshSecret === DEFAULT_REFRESH_SECRET) {
+    errors.push('JWT_REFRESH_SECRET must be set to a strong random value in production');
+  }
+  if (!process.env.DB_PASSWORD || dbPassword === DEFAULT_DB_PASSWORD) {
+    errors.push('DB_PASSWORD must be changed from the default in production');
+  }
+  if (!process.env.CLUSTER_KUBECONFIG_KEY?.trim()) {
+    errors.push('CLUSTER_KUBECONFIG_KEY must be set in production to encrypt stored kubeconfigs');
+  }
+
+  if (errors.length > 0) {
+    throw new Error(
+      `Production configuration validation failed:\n${errors.map((e) => `  - ${e}`).join('\n')}`,
+    );
+  }
+}