fix(helm): DEPL-003 + DEPL-006 — render viaHook env, sessionAffinity, HA backend default

Sprint 3 unified-master-audit closure — two Helm-chart correctness
defects with overlapping CI-guard surface.

DEPL-003 — CERTCTL_MIGRATIONS_VIA_HOOK never rendered:
  Pre-fix the env var was documented in values.yaml and the
  migration-job.yaml comment but never made it into the server
  Deployment env block. With migrations.viaHook=true the operator's
  intent is 'the pre-install/pre-upgrade Helm Job owns migrations,'
  but the server pods, missing the env, ran their own
  cmd/server/migrations.go::runBootMigrations alongside the hook
  Job, racing on the schema lock.
  Fix: render '- name: CERTCTL_MIGRATIONS_VIA_HOOK / value: true'
  in server-deployment.yaml under '{{- if .Values.migrations.viaHook }}'.

DEPL-006 — HA example missing rate-limit backend + sessionAffinity:
  values-prod-ha.yaml sets replicas:3 but inherited the chart-wide
  default rateLimiting.backend=memory (which gives each pod its
  own bucket map, effectively tripling the cap on a 3-replica fleet)
  AND the chart had no render path for server.service.sessionAffinity
  even though docs/operator/runbooks/ha.md instructed operators to
  set it for ClientIP-routed sticky sessions.
  Fix:
    - server-service.yaml gains a conditional sessionAffinity +
      sessionAffinityConfig.clientIP.timeoutSeconds render.
    - values.yaml grows the matching schema entries (default empty
      so single-replica deploys are unaffected).
    - values-prod-ha.yaml flips rateLimiting.backend=postgres and
      service.sessionAffinity=ClientIP.
    - NOTES.txt emits a loud warning when replicas>1 + either toggle
      is still in the default state, so the misconfig surfaces at
      helm install time instead of in a confused login-flow bug
      report a week later.

CI:
  scripts/ci-guards/B3-helm-chart-coherence.sh gains 'Check 7'
  (DEPL-003 viaHook env render — both positive and negative —
  the inverse case catches future drift that drops the {{- if }}
  guard) and 'Check 8' (DEPL-006 sessionAffinity render). Both
  helm-template through to assert the rendered YAML carries the
  expected text.

Closes DEPL-003, DEPL-006.

scripts/ci-guards/B3-helm-chart-coherence.sh

@@ -152,10 +152,62 @@ if helm template c "$CHART" \
   failed=1
 fi
 
+# Check 8 — DEPL-006 (Sprint 3 closure): when
+# server.service.sessionAffinity is set, server-service.yaml MUST
+# render the field. Pre-fix the chart silently dropped the value
+# and docs/operator/runbooks/ha.md's instructions had no effect.
+if helm template c "$CHART" \
+      --set server.tls.existingSecret=ci \
+      --set postgresql.auth.password=p \
+      --set server.auth.apiKey=k \
+      --set server.service.sessionAffinity=ClientIP \
+      > "$TMP/affinity.yaml" 2> "$TMP/affinity.err"; then
+  if ! grep -q 'sessionAffinity: ClientIP' "$TMP/affinity.yaml"; then
+    echo "::error file=${CHART}::B3 regression (DEPL-006): server.service.sessionAffinity=ClientIP did not render. Round-robin Service routing will break login + CSRF flows."
+    failed=1
+  fi
+else
+  echo "::error file=${CHART}::B3 regression (DEPL-006): sessionAffinity mode failed to render."
+  cat "$TMP/affinity.err"
+  failed=1
+fi
+
+# Check 7 — DEPL-003 (Sprint 3 closure): when migrations.viaHook=true
+# is set, the server Deployment env block MUST render
+# CERTCTL_MIGRATIONS_VIA_HOOK=true. Without it the server runs
+# boot-time migrations alongside the pre-install/pre-upgrade hook
+# Job, racing on the schema lock.
+if helm template c "$CHART" \
+      --set server.tls.existingSecret=ci \
+      --set postgresql.auth.password=p \
+      --set server.auth.apiKey=k \
+      --set migrations.viaHook=true \
+      > "$TMP/viahook.yaml" 2> "$TMP/viahook.err"; then
+  if ! grep -q 'name: CERTCTL_MIGRATIONS_VIA_HOOK' "$TMP/viahook.yaml"; then
+    echo "::error file=${CHART}::B3 regression (DEPL-003): migrations.viaHook=true did not render CERTCTL_MIGRATIONS_VIA_HOOK in the server Deployment env block. Server pods will race the hook Job."
+    failed=1
+  fi
+  # Inverse: with viaHook unset (default), the env var MUST NOT render.
+  if helm template c "$CHART" \
+        --set server.tls.existingSecret=ci \
+        --set postgresql.auth.password=p \
+        --set server.auth.apiKey=k \
+        > "$TMP/noviahook.yaml" 2> "$TMP/noviahook.err"; then
+    if grep -q 'name: CERTCTL_MIGRATIONS_VIA_HOOK' "$TMP/noviahook.yaml"; then
+      echo "::error file=${CHART}::B3 regression (DEPL-003): default render (viaHook=false) leaked CERTCTL_MIGRATIONS_VIA_HOOK env var. Conditional template missing the {{- if }} guard."
+      failed=1
+    fi
+  fi
+else
+  echo "::error file=${CHART}::B3 regression (DEPL-003): migrations.viaHook=true mode failed to render."
+  cat "$TMP/viahook.err"
+  failed=1
+fi
+
 if [ "$failed" -ne 0 ]; then
   echo ""
   echo "${GUARD_NAME}: FAILED — Helm chart coherence regression."
   exit 1
 fi
 
-echo "${GUARD_NAME}: clean (default + external-Postgres + cert-manager + production hardening + 3 fail-fast gates all green)."
+echo "${GUARD_NAME}: clean (default + external-Postgres + cert-manager + production hardening + 3 fail-fast gates + DEPL-003 viaHook env render all green)."