Production CI: workflows only, remove VM and shell deploy scripts

Replace deploy-aks-prod and VM deploy with deploy-production.yml (inline
ACR build, Key Vault sync, Helm). Add bootstrap-aks-platform.yml for rare
cluster setup. Delete one-off shell scripts, docker-compose.prod, and
legacy k8s manifests superseded by Helm.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Shaurya2k06

.github/workflows/bootstrap-aks-platform.yml

@@ -0,0 +1,113 @@
+name: Bootstrap AKS Platform
+
+# Run once per new cluster, or after disaster recovery. Not part of normal deploys.
+on:
+  workflow_dispatch:
+
+env:
+  AZURE_RESOURCE_GROUP: rg-vcr-protocol-prod-in
+  AKS_NAME: vcr-aks-prod
+  KEY_VAULT_NAME: vcr-kv-prod-in
+
+permissions:
+  contents: read
+
+jobs:
+  bootstrap:
+    name: Install ingress, cert-manager, external-secrets
+    runs-on: ubuntu-latest
+    environment: production
+    timeout-minutes: 45
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Azure login (JSON)
+        if: ${{ secrets.AZURE_CREDENTIALS != '' }}
+        uses: azure/login@v2
+        with:
+          creds: ${{ secrets.AZURE_CREDENTIALS }}
+
+      - name: Azure login (individual secrets)
+        if: ${{ secrets.AZURE_CREDENTIALS == '' }}
+        uses: azure/login@v2
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
+
+      - uses: azure/setup-kubectl@v4
+      - uses: azure/setup-helm@v4
+
+      - name: Configure kubectl
+        run: |
+          az aks get-credentials \
+            --resource-group "${{ env.AZURE_RESOURCE_GROUP }}" \
+            --name "${{ env.AKS_NAME }}" \
+            --overwrite-existing
+
+      - name: Install ingress-nginx
+        run: |
+          helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
+          helm repo update ingress-nginx
+          helm upgrade --install ingress-nginx ingress-nginx/ingress-nginx \
+            --namespace ingress-nginx \
+            --create-namespace \
+            -f infra/platform/ingress-nginx-values-prod.yaml \
+            --wait --timeout 15m
+
+      - name: Install cert-manager
+        run: |
+          if kubectl get deployment cert-manager -n cert-manager &>/dev/null; then
+            echo "cert-manager already installed"
+          else
+            helm repo add jetstack https://charts.jetstack.io
+            helm repo update jetstack
+            helm upgrade --install cert-manager jetstack/cert-manager \
+              --namespace cert-manager \
+              --create-namespace \
+              --set crds.enabled=true \
+              --wait --timeout 15m
+          fi
+          kubectl apply -f infra/platform/cluster-issuer.yaml
+
+      - name: Install external-secrets
+        env:
+          ESO_CLIENT_ID: ${{ secrets.ESO_CLIENT_ID }}
+        run: |
+          helm repo add external-secrets https://charts.external-secrets.io
+          helm repo update external-secrets
+          EXTRA=()
+          if [[ -n "${ESO_CLIENT_ID}" ]]; then
+            EXTRA+=(--set "serviceAccount.annotations.azure\.workload\.identity/client-id=${ESO_CLIENT_ID}")
+          else
+            ESO_ID="$(az identity show -g "${{ env.AZURE_RESOURCE_GROUP }}" -n vcr-eso-prod --query clientId -o tsv 2>/dev/null || true)"
+            [[ -n "${ESO_ID}" ]] && EXTRA+=(--set "serviceAccount.annotations.azure\.workload\.identity/client-id=${ESO_ID}")
+          fi
+          helm upgrade --install external-secrets external-secrets/external-secrets \
+            --namespace external-secrets \
+            --create-namespace \
+            -f infra/platform/external-secrets-values-prod.yaml \
+            "${EXTRA[@]}" \
+            --wait --timeout 10m
+
+      - name: Apply ClusterSecretStore
+        run: |
+          KV_URI="$(az keyvault show -g "${{ env.AZURE_RESOURCE_GROUP }}" -n "${{ env.KEY_VAULT_NAME }}" --query properties.vaultUri -o tsv)"
+          sed "s|\${KEY_VAULT_URI}|${KV_URI}|g" infra/platform/cluster-secret-store.yaml.tpl | kubectl apply -f -
+
+      - name: Label application namespace
+        run: |
+          kubectl create namespace vcr-protocol --dry-run=client -o yaml | kubectl apply -f -
+          kubectl label namespace vcr-protocol \
+            pod-security.kubernetes.io/enforce=restricted \
+            pod-security.kubernetes.io/enforce-version=latest \
+            pod-security.kubernetes.io/warn=restricted \
+            pod-security.kubernetes.io/warn-version=latest \
+            --overwrite
+
+      - name: Ingress IP
+        run: |
+          kubectl get svc -n ingress-nginx ingress-nginx-controller -o wide
+          echo "Point api.vcrprotocol.xyz A record to the EXTERNAL-IP above."

.github/workflows/ci.yml

@@ -85,11 +85,13 @@ jobs:
           npm ci --no-audit --no-fund
           npm run build
         env:
-          VITE_API_URL: http://20.219.105.217:3001
+          VITE_API_URL: https://api.vcrprotocol.xyz
 
   docker:
     name: API image build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4