fix(platform): inject ELASTIC_PASSWORD from platform secrets in production

Backend validate-production-config requires a non-default ELASTIC_PASSWORD;
read it from abrban-platform-secrets.elastic-password like other credentials.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/helm/cloudhost-platform/templates/backend-deployment.yaml

@@ -98,6 +98,11 @@ spec:
                 secretKeyRef:
                   name: {{ include "cloudhost-platform.secretName" . }}
                   key: cluster-kubeconfig-key
+            - name: ELASTIC_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "cloudhost-platform.secretName" . }}
+                  key: elastic-password
             - name: FRONTEND_URL
               value: {{ include "cloudhost-platform.corsOrigins" . | quote }}
             {{- include "cloudhost-platform.buildEnv" . | nindent 12 }}

backend/helm/cloudhost-platform/values.yaml

@@ -124,7 +124,7 @@ secrets:
   # Use a pre-created Secret instead of chart-managed one. Required for GitOps
   # (Argo CD renders with `helm template`, so lookup/randAlphaNum regenerate on
   # every sync). Secret must contain keys: postgres-password, jwt-secret,
-  # jwt-refresh-secret, cluster-kubeconfig-key.
+  # jwt-refresh-secret, cluster-kubeconfig-key, redis-password, elastic-password.
   existingSecret: ""
   jwtSecret: ""
   jwtRefreshSecret: ""

gitops/sealed-secrets/abrban-platform-secrets.example.yaml

@@ -3,7 +3,8 @@
 # Real SealedSecret lives in cloud-host-gitops/sealed-secrets/ — never commit plaintext passwords.
 #
 # Required keys (must match backend Deployment + validate-production-config):
-#   postgres-password, jwt-secret, jwt-refresh-secret, cluster-kubeconfig-key, redis-password
+#   postgres-password, jwt-secret, jwt-refresh-secret, cluster-kubeconfig-key,
+#   redis-password, elastic-password (must match elasticsearch-credentials in logging)
 #
 # Generate (replace CHANGE_ME_* with strong random values):
 #
@@ -13,6 +14,7 @@
 #     --from-literal=jwt-refresh-secret='CHANGE_ME_REFRESH_32CHARS_MIN' \
 #     --from-literal=cluster-kubeconfig-key='0123456789abcdef0123456789abcdef' \
 #     --from-literal=redis-password='CHANGE_ME_REDIS' \
+#     --from-literal=elastic-password='CHANGE_ME_ELASTIC' \
 #     --dry-run=client -o json \
 #   | kubeseal \
 #       --controller-name=sealed-secrets-controller \