feat(helm): values-local + values-us-prod

Local: in-cluster MariaDB + Valkey, port-forward instead of ingress,
chart-generated APP_KEY (dev only).
Prod: external MariaDB (ezscale ns), Longhorn-backed Valkey, Traefik
IngressRoute with cloudflarewarp + cert-manager TLS, image.tag set
at deploy time, secret pre-created out-of-band.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

helm/ezscale-website/values-local.yaml

@@ -0,0 +1,61 @@
+# ===========================================================================
+# Local k3d/minikube cluster — fully self-contained.
+# Prerequisite: mariadb-operator installed in the cluster.
+#   helm install mariadb-operator -n mariadb-operator --create-namespace \
+#     mariadb-operator/mariadb-operator
+# ===========================================================================
+
+image:
+  tag: latest
+  pullPolicy: Always
+
+imagePullSecrets: []   # no registry auth needed for locally-built images
+
+app:
+  replicaCount: 1
+  resources:
+    requests: { cpu: 100m, memory: 256Mi }
+
+mariadb:
+  enabled: true
+  replicas: 1
+  storage:
+    size: 5Gi
+    storageClassName: local-path
+
+valkey:
+  enabled: true
+  storage:
+    size: 1Gi
+    storageClassName: local-path
+
+migrate:
+  enabled: true
+  seed: true
+  seedClass: DemoDataSeeder
+
+ingressRoute:
+  enabled: false       # local uses port-forward, not Traefik
+
+# Local dev: chart generates a random APP_KEY on first install.
+# This is OK in local because there's no encrypted prod data to lose.
+# In production this MUST be `secret.create=false`.
+secret:
+  create: true
+  existingSecretName: ""
+  values:
+    APP_KEY: "base64:CHANGEME_GENERATE_VIA_PHP_ARTISAN_KEY_GENERATE_SHOW"
+    DB_PASSWORD: "local_dev_password"
+    AWS_ACCESS_KEY_ID: ""
+    AWS_SECRET_ACCESS_KEY: ""
+    STRIPE_KEY: ""
+    STRIPE_SECRET: ""
+
+env:
+  APP_ENV: local
+  APP_DEBUG: "true"
+  APP_URL: http://localhost
+  LOG_LEVEL: debug
+  FILESYSTEM_DISK: local
+  MAIL_MAILER: log
+  SESSION_DOMAIN: ""