Harden platform security, reliability, and CI after full audit.

Close deployment IDOR and gate stub payment endpoints, add production
secret validation, health probes, Redis-backed build progress, GitHub
Actions CI, expanded tests, billing/k8s refactors, and ops runbooks.

Co-authored-by: Cursor <cursoragent@cursor.com>

docker-compose.yml

@@ -55,10 +55,11 @@ services:
       DB_PORT: 5432
       DB_USERNAME: cloudhost
       DB_PASSWORD: cloudhost_secret
-      DB_NAME: cloudhost
+      DB_DATABASE: cloudhost
 
       # JWT
       JWT_SECRET: change-this-to-a-long-random-string
+      JWT_REFRESH_SECRET: change-this-to-a-long-random-refresh-string
       JWT_EXPIRES_IN: 15m
       JWT_REFRESH_EXPIRES_IN: 7d
 
@@ -73,9 +74,10 @@ services:
 
       # Build
       BUILD_NAMESPACE: cloudhost-builds
-      KANIKO_IMAGE: gcr.io/kaniko-project/executor:latest
+      KANIKO_IMAGE: gcr.io/kaniko-project/executor:v1.23.2
 
       # Platform
+      FRONTEND_URL: http://localhost:3000
       PLATFORM_DOMAIN: apps.localhost
     volumes:
       - /tmp/cloudhost-uploads:/app/uploads