Support production Kubernetes deployments in the Helm chart

[drybalka-s]

Problem

The Helm chart lacks several controls required for a production deployment in
an internal Kubernetes cluster. Operators need to connect external
infrastructure, use private images and corporate trust stores, harden pods, and
integrate the release with standard cluster policies without putting
credentials in Helm values.

Scope

• support arbitrary backend extraEnv and extraEnvFrom while retaining the
  chart ConfigMap and existingSecret
• expose non-secret PostgreSQL pool, URL/origin, logging, metrics, shutdown,
  SMTP, Redis/rate-limit, trusted-proxy, and S3-compatible storage settings
• support private registry pull secrets and digest-based images
• support extra volumes/mounts, pod/container security contexts, one shared
  ServiceAccount, lifecycle, and configurable probes
• add configurable deployment strategies, revision history, scheduling, pod
  metadata, and merged per-component Ingress annotations
• add optional NetworkPolicy, PodDisruptionBudget, metrics Service, and
  ServiceMonitor resources
• preserve the existing external Secret checksum behavior, embedded
  PostgreSQL, uploads PVC toggle, PrometheusRule, and frontend backend
  compatibility Service
• add a Helm values.schema.json and chart README

Secret values must remain in pre-created Kubernetes Secrets. Production
hardening features that can break existing installations must stay disabled or
empty by default.

Acceptance criteria

• default helm lint and helm template succeed without additional values
• external PostgreSQL and S3 without the uploads PVC render correctly
• all standard Kubernetes resources pass kubeconform -strict
• startup/liveness use /health; readiness uses /readyz
• no real credentials, controller-specific dependencies, or application
  changes are introduced

[drybalka-s]

Implementation: #5806

[drybalka-s]

Scope update: PR #5806 now also includes optional Gateway API HTTPRoute resources for separate frontend and backend routes. The feature is disabled by default for backward compatibility.

[drybalka-s]

ping