Harden platform security, reliability, and CI after full audit.

Close deployment IDOR and gate stub payment endpoints, add production
secret validation, health probes, Redis-backed build progress, GitHub
Actions CI, expanded tests, billing/k8s refactors, and ops runbooks.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/deployments/deployments.service.ts

@@ -463,14 +463,15 @@ export class DeploymentsService {
     }
   }
 
-  async findByApplication(applicationId: string): Promise<Deployment[]> {
+  async findByApplication(applicationId: string, userId?: string): Promise<Deployment[]> {
+    await this.applicationsService.findOne(applicationId, userId);
     return this.deploymentsRepository.find({
       where: { applicationId },
       order: { createdAt: 'DESC' },
     });
   }
 
-  async findOne(id: string): Promise<Deployment> {
+  async findOne(id: string, userId?: string): Promise<Deployment> {
     const deployment = await this.deploymentsRepository.findOne({
       where: { id },
       relations: { application: true },
@@ -478,6 +479,7 @@ export class DeploymentsService {
     if (!deployment) {
       throw new NotFoundException('Deployment not found');
     }
+    await this.applicationsService.findOne(deployment.applicationId, userId);
     return deployment;
   }
 
@@ -537,7 +539,7 @@ export class DeploymentsService {
 
     if (!latest) return null;
 
-    const progress = this.buildService.getProgress(latest.id);
+    const progress = await this.buildService.getProgress(latest.id);
     if (progress) return progress;
 
     // No in-memory progress — infer from deployment status