fix(deploy): build+wire sms-service, and give security the email/SMS/verification env it needs

[izzywdev]

Two merged features (phone 2FA #274, email verification #275) are non-functional in prod because the deploy wiring was never completed. This is the deploy/CI slice only — no app code touched.

Root cause: the release bump silently skipped 2 of 7 images

release.yml builds and pushes 7 images, but the tag-bump awk only anchored 5 (backend, frontend, security, applications, clock-app). email-service and sms-service were built on every release and then never written into values-prod.yaml.

The count guard could not catch this — it asserted COUNT -ne 5, and 5 anchors always produce exactly 5 rewrites. It was structurally incapable of noticing the two missing ones. Consequences:

• smsService.image.tag: "" → an empty tag, so sms-service was never deployed at all. Phone 2FA could not dispatch even though its routes answered.
• emailService.image.tag froze at a stale 1fbd206c5b2a while the built image moved on.

Fixed by anchoring both repositories and raising the guard to 7, with a comment tying the anchor list to the build steps.

Also found while wiring (both would have defeated the fix)

1. emailService.enabled was never set in values-prod.yaml — it defaults to false, so email-service was not merely stale, it was not deployed. Now enabled: true.
2. Twilio/SendGrid env was gated on .Values.secret.twilioAccountSid, which is empty in prod by design (real values live in the SealedSecret, prod uses existingSecret). So the gate stripped Twilio env in exactly the environment that needs it. Now gated on existingSecret too. Verified: all 3 Twilio keys render only after this fix.
3. The code's service-URL fallbacks are wrong. notifications.ts defaults to http://email-service:3000 / http://sms-service:3000 — matching neither the real Service names (fuzefront-email-service/fuzefront-sms-service) nor ports (3003/3004). The env is now rendered from the same values the Services are built from, so a port change cannot drift them apart.

Deliberate: two things stay OFF

• requireEmailVerification: false. Enabling it now would lock out every new signup: no SMTP_HOST is wired, so email-service defaults to a mailhog-style localhost:1025 and silently drops mail. Users would be created unverified and never receive the mail to verify. Prove a sender first, then flip. (Note: while false, the code auto-verifies everyone — verification is not enforced today either way.)
• smsService.enabled: false. Enabling it now would CrashLoop the pod: SMS_AUTH_SECRET is a hard secretKeyRef (no optional), and none of the 4 required keys exist in fuzefront-secrets (verified against the sealed manifest). The empty tag was hiding this.

This PR does not make either feature live — it makes them deployable. Go-live is owner-gated on sealing (below), then a GitOps flip in a deploy window.

Owner action required (I cannot do this — no credentials, and I will not commit secrets)

Seal 4 keys into fuzefront-secrets, per the new recipe in deploy/contabo/SEAL_PROD_SECRETS.md:

Key	Source
TWILIO_ACCOUNT_SID	Twilio console (AC…)
TWILIO_AUTH_TOKEN	Twilio console
TWILIO_VERIFY_SERVICE_SID	Twilio → Verify → Services (VA…)
SMS_AUTH_SECRET	mint it: openssl rand -hex 32 — internal shared secret, must match the Authentik SMS stage blueprint

Then flip smsService.enabled: true as a separate commit, so the secret is provably present before the Deployment renders.

Verification (real output)

$ helm template deploy/helm/fuzefront -f values-prod.yaml     → EXIT=0
    EMAIL_SERVICE_URL: "http://fuzefront-email-service:3003"
    REQUIRE_EMAIL_VERIFICATION: "false"
    (SMS_SERVICE_URL correctly absent while sms disabled)

$ helm template ... --set smsService.enabled=true             → EXIT=0
    Deployment fuzefront-sms-service renders, with
    TWILIO_ACCOUNT_SID / TWILIO_AUTH_TOKEN / TWILIO_VERIFY_SERVICE_SID / SMS_AUTH_SECRET

$ helm lint (values-prod.yaml)   → 1 chart(s) linted, 0 chart(s) failed
$ helm lint (values-local.yaml)  → 1 chart(s) linted, 0 chart(s) failed

$ kubeconform -strict -kubernetes-version 1.29.0 (CI's exact flags)
    values-prod:  41 resources in 20 files - Valid: 38, Invalid: 0, Errors: 0, Skipped: 3
    values-local: 32 resources in 17 files - Valid: 31, Invalid: 0, Errors: 0, Skipped: 1

$ awk bump simulation against the real values-prod.yaml → REWRITES=7 (matches the new guard)
    verified email-service and sms-service tags both rewritten

Out of scope — flagged, not fixed

provisioning-service and billing-service are also built by release.yml but also not anchored — the same latent bug class. Left alone deliberately: provisioning is disabled in prod (inert), and adding a billing anchor would silently re-tag the live money path — that deserves its own reviewed PR, not a rider on this one.

SMTP_HOST is not wired into email-service at all; that is the remaining gap before requireEmailVerification can be turned on.

Nothing was hand-applied — prod is GitOps.

Known pre-existing failing checks, unrelated to this PR: Playwright sign-in flow, OIDC plumbing, open-pr, gate-code-review.

🤖 Generated with Claude Code

[github-actions]

Automated code review (gate-code-review)

Credit balance is too low

Report-only — this check never blocks merge.