PILOT-9638: pilotx chart 1.10.0 — bridge config + GCP Secret Manager toggle

[vadimsoltan]

Summary

Adds optional Samba bridge integration to the pilotx chart, gated on appConfig.bridge.enabled. When enabled, the backend deployment receives the env vars needed to expose the internal bridge endpoints and provision per-share SMB password secrets in GCP Secret Manager. Bumps chart 1.9.0 → 1.10.1 and re-packages docs/ index per the README contribution flow.

ADR021 reference

• §Auth — bridge bearer token shared between backend (validates incoming bridge calls) and bridge VM (presents on outgoing reconcile calls)
• §Deployment — env-specific bridge_id matches the bridge VM's Terraform module input per environment

What the chart now produces

When appConfig.bridge.enabled=true:

- name: PILOTX_BRIDGE_ID
  value: "lab-dev-samba-bridge"            # from appConfig.bridge.bridgeId
- name: PILOTX_BRIDGE_PASSWORD_SECRET_PREFIX
  value: "project-share"                    # from appConfig.bridge.passwordSecretPrefix
- name: PILOTX_BRIDGE_API_TOKEN
  valueFrom:
    secretKeyRef:
      name: pilotx-bridge-token             # from bridgeSecret.existingSecret
      key: PILOTX_BRIDGE_API_TOKEN          # from bridgeSecret.secretKeys.apiToken

Always (regardless of bridge.enabled):

- name: PILOTX_GCP_SECRETMANAGER_ENABLED
  value: "false"                            # from appConfig.gcp.secretManagerEnabled

Validation

• appConfig.bridge.enabled=true without bridgeSecret.existingSecret → helm template hard-fails with a clear message
• appConfig.bridge.enabled=true without appConfig.bridge.bridgeId → hard-fails

Verified with helm template:

• Default values: bridge env vars omitted, secret-manager toggle = false ✓
• Enabled with valid config: all four env vars render correctly ✓
• Enabled with missing required: hard fails ✓

Per-environment values (set by chart consumers)

appConfig:
  bridge:
    enabled: true
    bridgeId: lab-dev-samba-bridge          # or lab-staging-samba-bridge, etc.
  gcp:
    secretManagerEnabled: true
bridgeSecret:
  existingSecret: pilotx-bridge-auth-token  # synced from GCP Secret Manager via External Secrets Operator

The K8s secret should be sourced from GCP Secret Manager (e.g. via External Secrets Operator) and reference the same value as the bridge VM's controller_auth_secret_id Terraform module input.

Test plan

• helm lint pilotx passes with default values
• helm template renders correctly with bridge disabled (default)
• helm template renders correctly with bridge enabled + valid config
• helm template hard-fails with bridge enabled + missing required fields
• helm package produces pilotx-1.10.1.tgz
• helm repo index updates docs/index.yaml without dropping other chart entries