ci: upgrade Helm to v4.1.4, switch images to Alpine 3.23, disable backup cron

- release.yml: bump Helm v3.16.2 → v4.1.4; replace --wait with
  --rollback-on-failure (Helm 4 rename, implies --wait)
- Dockerfile: backend builder rust:1.95-slim-bookworm → rust:1.95-alpine3.23
  (adds cmake/g++/perl/nasm/sqlite-dev for aws-lc-rs + sqlx); runtime
  debian:trixie-slim → alpine:3.23 (adds sqlite-libs, uses adduser -D)
- cronjob-backup: gate on backup.enabled, pin image to alpine:3.23
- values.yaml: backup.enabled default true
- values_override.yaml: backup.enabled: false (disabled until tested)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

deploy/templates/cronjob-backup.yaml

@@ -1,3 +1,4 @@
+{{- if .Values.backup.enabled }}
 apiVersion: batch/v1
 kind: CronJob
 metadata:
@@ -25,7 +26,7 @@ spec:
                   topologyKey: kubernetes.io/hostname
           containers:
             - name: backup
-              image: alpine:latest
+              image: alpine:3.23
               command:
                 - /bin/sh
                 - -c
@@ -40,3 +41,4 @@ spec:
             - name: data
               persistentVolumeClaim:
                 claimName: {{ include "tutortool.fullname" . }}-data
+{{- end }}

deploy/values.yaml

@@ -48,6 +48,9 @@ httpRoute:
 # Do not set jwtSecretValue in committed values — provision via kubectl manually.
 jwtSecretName: tutortool-jwt
 
+backup:
+  enabled: true
+
 env:
   DATABASE_URL: sqlite:/data/attendance.db
   STATIC_DIR: /app/frontend/build

deploy/values_override.yaml

@@ -7,3 +7,6 @@ image:
 
 env:
   extra: {}
+
+backup:
+  enabled: false