Harden platform security, reliability, and CI after full audit.

Close deployment IDOR and gate stub payment endpoints, add production
secret validation, health probes, Redis-backed build progress, GitHub
Actions CI, expanded tests, billing/k8s refactors, and ops runbooks.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/test-setup.ts

@@ -0,0 +1,10 @@
+/** Prevent Jest from loading ESM-only @kubernetes/client-node in unit tests. */
+jest.mock('@kubernetes/client-node', () => ({
+  KubeConfig: jest.fn(),
+  CoreV1Api: jest.fn(),
+  AppsV1Api: jest.fn(),
+  BatchV1Api: jest.fn(),
+  NetworkingV1Api: jest.fn(),
+  CustomObjectsApi: jest.fn(),
+  HttpError: class HttpError extends Error {},
+}));