revert(build): remove app build pipeline revamp (Nixpacks/MinIO/Trivy/registry GC)

Reverts commits 3eff38f and c379a23 and restores the previous Kaniko-only
build pipeline (runtime detection + per-runtime Dockerfile generation,
disk-based source upload).

Removed: Nixpacks Dockerfile generation, MinIO source storage (common/storage),
Bull build queue + Redis build state (common/redis, deployment.processor),
Trivy image scan (scan.service, deployment.vulnerabilitySummary), and daily
registry garbage collection (registry-gc). Nothing outside the build/deploy
path depended on these. Backend tsc + 105/106 tests green (the pre-existing
helm.service chartPath failure is unrelated); frontend tsc green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/common/redis/redis.module.ts

@@ -1,51 +0,0 @@
-import { Global, Module, OnApplicationShutdown, Logger } from '@nestjs/common';
-import { ModuleRef } from '@nestjs/core';
-import { ConfigService } from '@nestjs/config';
-import IORedis, { Redis } from 'ioredis';
-
-/** Injection token for the shared ioredis client. */
-export const REDIS_CLIENT = 'REDIS_CLIENT';
-
-/**
- * Shared Redis client used for build state (progress / cancel flags / build
- * sessions) so the data survives across backend replicas — unlike the previous
- * in-memory Maps that only worked with a single instance.
- *
- * Reuses the same connection details as the Bull queue (`redis.host/port`).
- */
-@Global()
-@Module({
-  providers: [
-    {
-      provide: REDIS_CLIENT,
-      inject: [ConfigService],
-      useFactory: (configService: ConfigService): Redis => {
-        const client = new IORedis({
-          host: configService.get<string>('redis.host'),
-          port: configService.get<number>('redis.port'),
-          // Build state writes are best-effort telemetry — never let a Redis
-          // hiccup take down the request that triggered them.
-          maxRetriesPerRequest: 2,
-          enableOfflineQueue: true,
-        });
-        client.on('error', (err) => {
-          new Logger('RedisClient').warn(`Redis connection error: ${err.message}`);
-        });
-        return client;
-      },
-    },
-  ],
-  exports: [REDIS_CLIENT],
-})
-export class RedisModule implements OnApplicationShutdown {
-  constructor(private readonly moduleRef: ModuleRef) {}
-
-  async onApplicationShutdown(): Promise<void> {
-    try {
-      const client = this.moduleRef.get<Redis>(REDIS_CLIENT, { strict: false });
-      await client?.quit();
-    } catch {
-      /* ignore shutdown errors */
-    }
-  }
-}

backend/src/common/storage/storage.module.ts

@@ -1,13 +0,0 @@
-import { Global, Module } from '@nestjs/common';
-import { StorageService } from './storage.service';
-
-/**
- * Global module exposing the MinIO-backed {@link StorageService} so both the API
- * (source upload) and the build pipeline (presigned download) can inject it.
- */
-@Global()
-@Module({
-  providers: [StorageService],
-  exports: [StorageService],
-})
-export class StorageModule {}

backend/src/common/storage/storage.service.ts

@@ -1,64 +0,0 @@
-import { Injectable, Logger } from '@nestjs/common';
-import { ConfigService } from '@nestjs/config';
-import * as Minio from 'minio';
-
-/**
- * Object storage for application source archives, backed by the in-cluster MinIO
- * (S3-compatible). Replaces the previous local-disk + PVC + kubectl-cp upload path:
- * the API streams the uploaded zip straight to MinIO, and build pods pull it via a
- * short-lived presigned URL (no credentials, no kubectl, no helper pod).
- */
-@Injectable()
-export class StorageService {
-  private readonly logger = new Logger(StorageService.name);
-  private readonly client: Minio.Client;
-  private readonly bucket: string;
-  private bucketReady = false;
-
-  constructor(private readonly configService: ConfigService) {
-    this.bucket = this.configService.get<string>('minio.bucket') || 'app-sources';
-    this.client = new Minio.Client({
-      endPoint: this.configService.get<string>('minio.endpoint') || 'minio.cloudhost-builds.svc.cluster.local',
-      port: this.configService.get<number>('minio.port') || 9000,
-      useSSL: this.configService.get<boolean>('minio.useSSL') || false,
-      accessKey: this.configService.get<string>('minio.accessKey') || 'cloudhost',
-      secretKey: this.configService.get<string>('minio.secretKey') || '',
-    });
-  }
-
-  /** Object key for an app's source archive. */
-  sourceKey(userId: string, appId: string): string {
-    return `${userId}/${appId}/source.zip`;
-  }
-
-  private async ensureBucket(): Promise<void> {
-    if (this.bucketReady) return;
-    const exists = await this.client.bucketExists(this.bucket).catch(() => false);
-    if (!exists) {
-      await this.client.makeBucket(this.bucket);
-      this.logger.log(`Created MinIO bucket "${this.bucket}"`);
-    }
-    this.bucketReady = true;
-  }
-
-  /** Upload an app's source archive; returns the stored object key (saved as app.codePath). */
-  async putSource(userId: string, appId: string, data: Buffer): Promise<string> {
-    await this.ensureBucket();
-    const key = this.sourceKey(userId, appId);
-    await this.client.putObject(this.bucket, key, data, data.length, { 'Content-Type': 'application/zip' });
-    this.logger.log(`Uploaded source ${(data.length / 1024 / 1024).toFixed(1)}MB → ${this.bucket}/${key}`);
-    return key;
-  }
-
-  /** Short-lived presigned GET URL the build pod uses to download the source. */
-  async presignSourceGet(key: string, expirySeconds = 3600): Promise<string> {
-    return this.client.presignedGetObject(this.bucket, key, expirySeconds);
-  }
-
-  /** Best-effort delete of an app's source object (e.g. on app deletion). */
-  async removeSource(key: string): Promise<void> {
-    await this.client.removeObject(this.bucket, key).catch((e) => {
-      this.logger.warn(`Failed to remove source ${key}: ${e.message}`);
-    });
-  }
-}