feat(helm): ConfigMap + Secret templates

ConfigMap renders all non-secret env vars including dynamic DB_HOST
and REDIS_HOST. Secret template only renders when secret.create=true
(dev convenience); production references an existing Secret.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

helm/ezscale-website/templates/configmap.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "ezscale-website.fullname" . }}-env
+  labels: {{- include "ezscale-website.labels" . | nindent 4 }}
+data:
+  {{- range $key, $value := .Values.env }}
+  {{ $key }}: {{ $value | quote }}
+  {{- end }}
+  DB_HOST: {{ include "ezscale-website.dbHost" . | quote }}
+  REDIS_HOST: {{ include "ezscale-website.redisHost" . | quote }}