feat(helm): ConfigMap + Secret templates

ConfigMap renders all non-secret env vars including dynamic DB_HOST
and REDIS_HOST. Secret template only renders when secret.create=true
(dev convenience); production references an existing Secret.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

helm/ezscale-website/templates/secret.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.secret.create -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "ezscale-website.fullname" . }}-secrets
+  labels: {{- include "ezscale-website.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+  {{- range $key, $value := .Values.secret.values }}
+  {{ $key }}: {{ $value | quote }}
+  {{- end }}
+{{- end -}}