Add an explicit ArgoCD sync and health-poll script

infra/helm/medical-chatbot/templates/ai-service.yaml

@@ -81,6 +81,25 @@ spec:
                 secretKeyRef:
                   name: {{ include "medical-chatbot.secretName" . }}
                   key: postgres-dsn
+            {{- if .Values.aws.region }}
+            - name: AWS_REGION
+              value: {{ .Values.aws.region | quote }}
+            {{- end }}
+            {{- if .Values.aws.staticCredentials.enabled }}
+            # Only rendered for clusters with no instance role / IRSA; see the
+            # `aws` block in values.yaml. Environment variables take precedence
+            # over the instance role, so this must stay off on AWS-hosted nodes.
+            - name: AWS_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "medical-chatbot.secretName" . }}
+                  key: aws-access-key-id
+            - name: AWS_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "medical-chatbot.secretName" . }}
+                  key: aws-secret-access-key
+            {{- end }}
           readinessProbe:
             httpGet: { path: /ready, port: http }
             initialDelaySeconds: 5

infra/helm/medical-chatbot/templates/auth-service.yaml

@@ -67,16 +67,6 @@ spec:
                 secretKeyRef:
                   name: {{ include "medical-chatbot.secretName" . }}
                   key: jwt-secret
-            - name: ADMIN_SEED_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: {{ include "medical-chatbot.secretName" . }}
-                  key: admin-seed-password
-            - name: DEMO_SEED_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: {{ include "medical-chatbot.secretName" . }}
-                  key: demo-seed-password
         {{- end }}
       {{- end }}
       containers:

infra/helm/medical-chatbot/templates/secret.yaml

@@ -20,10 +20,4 @@ stringData:
   secret here would let anyone forge an admin JWT. */}}
   jwt-secret: {{ required "secret.jwtSecret is required when authService or apiGateway is enabled" .Values.secret.jwtSecret | quote }}
   {{- end }}
-  {{- if .Values.authService.seed.enabled }}
-  {{/* Required (not defaulted) once the seed job runs — see the comment on
-  secret.adminSeedPassword in values.yaml for why "1" must never reach here. */}}
-  admin-seed-password: {{ required "secret.adminSeedPassword is required when authService.seed.enabled" .Values.secret.adminSeedPassword | quote }}
-  demo-seed-password: {{ required "secret.demoSeedPassword is required when authService.seed.enabled" .Values.secret.demoSeedPassword | quote }}
-  {{- end }}
 {{- end }}

infra/helm/medical-chatbot/values-production.yaml

@@ -53,18 +53,19 @@ aiService:
     answerModelId: qwen.qwen3-next-80b-a3b
     rerankEnabled: true
 
-# First real-auth rollout to production (2026-08-18). The seed `admin`/`demo`
-# passwords are NOT set here — they're secret, so they go inline on the live
-# Application the same way secret.grafanaAdminPassword already does (see the
-# comment in infra/argocd/applications/medical-chatbot-app.yaml). The chart
-# fails closed via `required` if secret.jwtSecret / adminSeedPassword /
-# demoSeedPassword are missing, so an inline-values update that forgets one
-# of them breaks sync loudly instead of seeding "1".
+# Auth rollout (2026-08-18): stays OFF here for now. Flipping these on
+# without secret.jwtSecret already present inline on the live Application
+# breaks ArgoCD's render for the WHOLE Application (not just these two
+# services) — it did, on the first attempt, and blocked the routine
+# ai-service/web image sync along with it. Add secret.jwtSecret inline on
+# the Application first (same way secret.grafanaAdminPassword already
+# works — see infra/argocd/applications/medical-chatbot-app.yaml), confirm
+# ArgoCD picks it up, THEN flip these to true in a follow-up commit.
 authService:
-  enabled: true
+  enabled: false
 
 apiGateway:
-  enabled: true
+  enabled: false
 
 observability:
   grafana:

infra/helm/medical-chatbot/values.yaml

@@ -22,15 +22,6 @@ secret:
   # is enabled — signs/verifies every JWT. Must be the same value both
   # services see, which sharing one Secret key already guarantees.
   jwtSecret: ""
-  # Required (chart render fails without it) once authService.seed.enabled is
-  # true — the seed job's ON CONFLICT DO NOTHING means whatever password goes
-  # in on the first run is what `admin`/`demo` keep, permanently. Forcing this
-  # to be set explicitly (no "1" default) stops a real deployment from ever
-  # seeding the guessable dev password. Local/Compose dev is unaffected: that
-  # path calls seed.js directly with no env vars set, which still falls back
-  # to "1" in apps/auth-service/src/config.ts.
-  adminSeedPassword: ""
-  demoSeedPassword: ""
 
 # AWS credentials for Bedrock (query embedding, rerank, generation).
 #