fix(helm): skip registry-pull-secret if already exists in namespace

- Use Helm lookup to check if secret exists before creating
- Add helm.sh/resource-policy: keep to prevent deletion
- Use pre-install hook to avoid ownership conflicts between releases

backend/helm/cloudhost-app/templates/registry-pull-secret.yaml

@@ -1,13 +1,20 @@
 {{- $name := include "cloudhost-app.name" . -}}
 {{- $ns   := include "cloudhost-app.namespace" . -}}
 {{- $registryUrl := .Values.registry.url | default "localhost:30500" -}}
+{{- $existingSecret := lookup "v1" "Secret" $ns "registry-pull-secret" -}}
+{{- if not $existingSecret }}
 apiVersion: v1
 kind: Secret
 metadata:
   name: registry-pull-secret
   namespace: {{ $ns }}
+  annotations:
+    "helm.sh/resource-policy": keep
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-weight": "-10"
   labels:
-    {{- include "cloudhost-app.labels" . | nindent 4 }}
+    app.kubernetes.io/managed-by: cloudhost
 type: kubernetes.io/dockerconfigjson
 data:
   .dockerconfigjson: {{ printf `{"auths":{"%s":{"auth":""}}}` $registryUrl | b64enc | quote }}
+{{- end }}