fix(build): default Kaniko and init images to Harbor via Helm values

User-app builds no longer pull gcr.io/docker.io directly when build.images
is configured in values.yaml, fixing ImagePullBackOff on clusters without
upstream registry access.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/config/configuration.ts

@@ -135,12 +135,21 @@ export default () => ({
     namespace: process.env.BUILD_NAMESPACE || 'cloudhost-builds',
     serviceAccount: process.env.BUILD_SERVICE_ACCOUNT || 'kaniko-builder',
     /**
-     * Optional registry prefix for Docker Hub base images used in generated
-     * Dockerfiles and managed-service charts (e.g. "mirror.example.com" makes
-     * `node:20-alpine` → `mirror.example.com/node:20-alpine`). Useful when
-     * cluster nodes cannot reach docker.io directly.
+     * Registry prefix for Docker Hub base images used in generated Dockerfiles
+     * and managed-service charts (e.g. `node:20-alpine` →
+     * `registry.abrban.com/proxy-dockerhub/library/node:20-alpine`).
      */
-    baseImageRegistry: (process.env.BASE_IMAGE_REGISTRY || '').trim().replace(/\/+$/, ''),
+    baseImageRegistry: (process.env.BASE_IMAGE_REGISTRY || 'registry.abrban.com/proxy-dockerhub/library')
+      .trim()
+      .replace(/\/+$/, ''),
+    /** Full image refs for Kaniko jobs — override via Helm values or env. */
+    images: {
+      kaniko:
+        process.env.KANIKO_IMAGE ||
+        'registry.abrban.com/proxy-gcr/kaniko-project/executor:v1.23.2',
+      alpine: (process.env.BUILD_ALPINE_IMAGE || 'registry.abrban.com/proxy-dockerhub/library/alpine:3.19').trim(),
+      alpineGit: (process.env.BUILD_ALPINE_GIT_IMAGE || 'registry.abrban.com/proxy-dockerhub/alpine/git:2.43.0').trim(),
+    },
     /** Kaniko build container resources — tune for large images. */
     kaniko: {
       cpuRequest: process.env.KANIKO_CPU_REQUEST || '500m',