fix: remove hardcoded postgres.host from prod/preprod helmreleases

[yodem]

Summary

• Removes hardcoded postgres.host from prod and preprod HelmRelease values
• Both environments will now source DATABASES_HOST from the local-settings-secrets-production secret
• The chart template already has the fallback: os.getenv("DATABASES_HOST") when postgres.host is unset (local-settings-file.yaml:90)

Prerequisite: infrastructure secret update

DO NOT MERGE until the infrastructure secret is updated and Flux-reconciled.

The current DATABASES_HOST in local-settings-secrets-production is stale — it points to prod1-pgbouncer.default.svc (from the pre-migration setup). It must be updated to postgres-18 before this PR lands.

How it works

The chart template at helm-chart/sefaria/templates/configmap/local-settings-file.yaml:90:

'HOST': {{ if .Values.postgres.host }}'{{ .Values.postgres.host }}'{{ else }}os.getenv("DATABASES_HOST"){{ end }},

When postgres.host is not set in values, Django reads DATABASES_HOST from the environment (injected from the secret via envFrom).

Test plan

• Infrastructure secret updated: DATABASES_HOST → postgres-18
• Flux reconciliation applied the secret to the cluster
• Verify prod pods start correctly after this PR merges
• Verify preprod pods start correctly
• Confirm postgres connection is to postgres-18 (check Django logs or admin)
• Verify postgres backup cronjob still works (uses its own hardcoded DATABASES_HOST: "postgres")

[gitvelocity-reviewer]

📊 Code Quality Score: 2/100

15 (base) × 0.1 (Nano ESF) = 1.5, rounded to 2

Category	Score	Factors
🔭 Scope	3/20	2 infra config files, same deletion pattern, single subsystem (database config)
🏗️ Architecture	2/20	Removes explicit host override, shifts dependency to chart default; minor but meaningful dependency change
⚙️ Implementation	1/20	Pure YAML deletion, no logic, no algorithms
⚠️ Risk	8/20	Production database connectivity affected; both preprod and prod changed in same PR reducing staged validation; no rollback plan documented; postgres host resolution change could cause outage if chart default differs
✅ Quality	1/15	No PR description explaining rationale; no validation plan; no documentation of chart default value being relied upon
🔒 Perf / Security	0/5	No performance or security considerations addressed

_{Scored by GitVelocity · How are scores calculated?}