Helm deployment

helm install spendguard ./charts/spendguard \
    --set postgres.ledgerUrl="postgres://..." \
    --set postgres.canonicalUrl="postgres://..." \
    --set secrets.tls.existingSecret="spendguard-tls" \
    --set secrets.bundles.existingSecret="spendguard-bundles"

See charts/spendguard/README.md for prerequisites (PKI Secret format, bundle Secret format, webhook HMAC secret, Postgres connection).

POC limits: - replicas=1 enforced by default for sidecar / outbox-forwarder / ttl-sweeper. See POC vs GA gates. - Migration job is a placeholder; apply ledger + canonical SQL migrations via your preferred tool (sqitch / flyway / golang-migrate).