chore(helm): address remaining Helm chart hardening items

[cevheri]

Context

PR #44 introduced the Helm chart. Copilot review flagged several non-critical hardening items that were deferred. All CI checks pass and the chart is functional — these are DX and edge-case improvements.

Tasks

• values.schema.json — expand coverage: Add missing properties (serviceAccount, podSecurityContext, securityContext, imagePullSecrets, tolerations, affinity, topologySpreadConstraints, networkPolicy.*, service.annotations, ingress.hosts/tls, persistence.accessModes/annotations, extraEnv, extraEnvFrom). Improves IDE autocomplete and helm lint --strict validation.

• secret.yaml — enforce jwtSecret minLength 32: Currently required only checks non-empty. Add a Go template length check or minLength: 32 in values.schema.json to fail-fast on short JWT secrets instead of runtime crash.

• pdb.yaml — handle minAvailable: 0 truthiness: Replace {{- if .Values.podDisruptionBudget.minAvailable }} with a kindIs / ne nil check so explicit 0 is preserved. Also enforce mutual exclusivity with maxUnavailable.

• hpa.yaml — guard against SQLite + HPA conflict: When storageProvider=sqlite, either disable HPA rendering with a warning or clamp maxReplicas: 1 to prevent multi-replica SQLite writes.

Priority

Low — none of these are blockers. The chart is production-ready for standard usage patterns.

🤖 Generated with Claude Code