Enable auth-service/api-gateway on production, build their images in CI

infra/helm/medical-chatbot/values.yaml

@@ -18,6 +18,46 @@ secret:
   # data/app split pattern) — overrides the default in-release host.
   postgresHost: ""
   grafanaAdminPassword: change-me
+  # Required (chart render fails without it) once authService or apiGateway
+  # is enabled — signs/verifies every JWT. Must be the same value both
+  # services see, which sharing one Secret key already guarantees.
+  jwtSecret: ""
+  # Required (chart render fails without it) once authService.seed.enabled is
+  # true — the seed job's ON CONFLICT DO NOTHING means whatever password goes
+  # in on the first run is what `admin`/`demo` keep, permanently. Forcing this
+  # to be set explicitly (no "1" default) stops a real deployment from ever
+  # seeding the guessable dev password. Local/Compose dev is unaffected: that
+  # path calls seed.js directly with no env vars set, which still falls back
+  # to "1" in apps/auth-service/src/config.ts.
+  adminSeedPassword: ""
+  demoSeedPassword: ""
+
+# AWS credentials for Bedrock (query embedding, rerank, generation).
+#
+# Leave `staticCredentials.enabled: false` on AWS-hosted nodes. Both the
+# Compose host and the k3s node run on EC2, where boto3 resolves credentials
+# from the instance role over IMDS and no key material exists on disk or in
+# any manifest — that is the posture every deployment has used so far, and it
+# is the safer one. `adapters/bedrock_converse.py` builds its client without
+# passing credentials, so boto3's own chain applies: environment variables
+# first, then shared config, then the instance role.
+#
+# Turn this on only for a cluster with no instance role and no IRSA — an
+# on-prem cluster, for example — where that chain would find nothing and every
+# Bedrock call would fail to authenticate. Because environment variables win
+# over the instance role, leaving this off keeps current behaviour exactly.
+aws:
+  # Overrides config.py's `aws_region` default (us-east-1); empty leaves the
+  # application default in place. The adapter passes this region to boto3
+  # explicitly, and pydantic-settings reads this same variable name.
+  region: ""
+  staticCredentials:
+    enabled: false
+    # Used when `secret.create` is true. When pointing at an existing Secret
+    # (`secret.existingSecret`), leave these empty and add the same two keys —
+    # `aws-access-key-id` and `aws-secret-access-key` — to that Secret instead.
+    accessKeyId: ""
+    secretAccessKey: ""
 
 aiService:
   enabled: true
@@ -68,6 +108,48 @@ web:
     requests: { cpu: 50m, memory: 128Mi }
     limits: { cpu: 500m, memory: 512Mi }
 
+# Both default OFF: this first slice's code exists and can be deployed, but
+# turning it on for real production traffic is a separate, later, explicit
+# decision — see the plan this was built from. A fresh `helm install` with
+# every other default is unaffected either way.
+authService:
+  enabled: false
+  replicaCount: 1
+  image:
+    repository: duocthu-auth-service
+    tag: local
+    pullPolicy: IfNotPresent
+  service:
+    type: ClusterIP
+    port: 3010
+  config:
+    jwtExpiresIn: 12h
+  migration:
+    enabled: true
+  # Idempotent (ON CONFLICT DO NOTHING) — safe to leave on every deploy.
+  # Disable once real registration replaces the two seed accounts, or if the
+  # `admin`/`demo` passwords have been rotated and must not be reset back to
+  # `"1"` by a future rollout.
+  seed:
+    enabled: true
+  resources:
+    requests: { cpu: 50m, memory: 128Mi }
+    limits: { cpu: 250m, memory: 256Mi }
+
+apiGateway:
+  enabled: false
+  replicaCount: 1
+  image:
+    repository: duocthu-api-gateway
+    tag: local
+    pullPolicy: IfNotPresent
+  service:
+    type: ClusterIP
+    port: 3000
+  resources:
+    requests: { cpu: 50m, memory: 128Mi }
+    limits: { cpu: 250m, memory: 256Mi }
+
 ingress:
   enabled: false
   className: nginx