Enable auth-service/api-gateway on production, build their images in CI

infra/helm/medical-chatbot/templates/web.yaml

@@ -27,6 +27,20 @@ spec:
           env:
             - name: AI_SERVICE_URL
               value: {{ printf "http://%s-ai-service:%v" (include "medical-chatbot.fullname" .) .Values.aiService.service.port | quote }}
+            {{- if .Values.apiGateway.enabled }}
+            - name: API_GATEWAY_URL
+              value: {{ printf "http://%s-api-gateway:%d" (include "medical-chatbot.fullname" .) (.Values.apiGateway.service.port | int) | quote }}
+            {{- end }}
+            {{- if or .Values.authService.enabled .Values.apiGateway.enabled }}
+            {{/* Only middleware.ts needs this (verifies the admin JWT locally
+            at the edge) — the BFF routes never see it, they just forward the
+            cookie's raw token to the gateway. */}}
+            - name: JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "medical-chatbot.secretName" . }}
+                  key: jwt-secret
+            {{- end }}
           ports:
             - { name: http, containerPort: 3000 }
           readinessProbe: