Add values for the standalone GitOps demo release (finalduocthu.realvuxbaro.me)

infra/helm/medical-chatbot/values-gitea-demo.yaml

@@ -0,0 +1,62 @@
+# GitOps demo release — full copy of production, source read from
+# git.vinmec.tech/VuQuangBao/duocthu instead of GitHub. Separate EC2, separate
+# cluster, own Postgres/Qdrant (single-release, not split like production —
+# this box is short-lived and disposable, the split's prune-safety benefit
+# does not matter here).
+#
+# Real secrets (grafana/jwt/postgres passwords) are generated fresh for this
+# box and stay inline on the ArgoCD Application, same pattern as production —
+# never in this tracked file.
+
+global:
+  environment: gitea-demo
+  imagePullSecrets:
+    - name: ghcr-pull-secret
+
+aiService:
+  config:
+    embeddingProvider: cohere-v4
+    embeddingDimensions: 1024
+    evidenceMinimumScore: 0.12
+    awsRegion: us-east-1
+    answerProvider: bedrock-converse
+    answerModelId: qwen.qwen3-next-80b-a3b
+    rerankEnabled: true
+    qdrantCollection: duocthu_v1
+    metricsEnabled: true
+    otelEnabled: true
+    otelSampleRatio: 1.0
+
+authService:
+  enabled: true
+
+apiGateway:
+  enabled: true
+
+postgres:
+  enabled: true
+
+qdrant:
+  enabled: true
+
+observability:
+  enabled: true
+  grafana:
+    anonymous:
+      enabled: true
+      role: Viewer
+
+ingress:
+  enabled: true
+  className: traefik
+  host: finalduocthu.realvuxbaro.me
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+  # DNS confirmed resolving to this box before this block was added -- same
+  # ordering that let the 2026-08-17 cutover issue its cert on the first
+  # attempt instead of burning failed-validation ACME orders.
+  tls:
+    - hosts:
+        - finalduocthu.realvuxbaro.me
+      secretName: finalduocthu-tls