Add an explicit ArgoCD sync and health-poll script

infra/helm/medical-chatbot/values-production.yaml

@@ -53,18 +53,19 @@ aiService:
     answerModelId: qwen.qwen3-next-80b-a3b
     rerankEnabled: true
 
-# First real-auth rollout to production (2026-08-18). The seed `admin`/`demo`
-# passwords are NOT set here — they're secret, so they go inline on the live
-# Application the same way secret.grafanaAdminPassword already does (see the
-# comment in infra/argocd/applications/medical-chatbot-app.yaml). The chart
-# fails closed via `required` if secret.jwtSecret / adminSeedPassword /
-# demoSeedPassword are missing, so an inline-values update that forgets one
-# of them breaks sync loudly instead of seeding "1".
+# Auth rollout (2026-08-18): stays OFF here for now. Flipping these on
+# without secret.jwtSecret already present inline on the live Application
+# breaks ArgoCD's render for the WHOLE Application (not just these two
+# services) — it did, on the first attempt, and blocked the routine
+# ai-service/web image sync along with it. Add secret.jwtSecret inline on
+# the Application first (same way secret.grafanaAdminPassword already
+# works — see infra/argocd/applications/medical-chatbot-app.yaml), confirm
+# ArgoCD picks it up, THEN flip these to true in a follow-up commit.
 authService:
-  enabled: true
+  enabled: false
 
 apiGateway:
-  enabled: true
+  enabled: false
 
 observability:
   grafana: