feat(charts): productize streaming-hub ConfigMap onto lerian-common

[guimoreirar]

Stacked on #1712 (which adds the chart). Retarget to main once #1712 merges.

What

Productizes the streaming-hub ConfigMap onto the lerian-common library chart, following the #1741 pattern already applied to br-ccs/br-sta/br-slc: every non-sensitive env key resolves through lerian-common.cfgValue into typed, schema-validated grouped blocks.

Precedence: common.configmap.<KEY> (native escape hatch) > streamingHub.<group>.<field> (grouped param) > chart default. Defaults live in the template; grouped blocks ship empty ({}).

Guarantees

• 0 value changes on the 39 pre-existing keys (verified by rendering HEAD vs this branch and diffing every shared key).
• 28 real .env-contract gaps closed — dispatch, pull, idempotency, autodisable, manifest, kafka TLS/SCRAM-username/CA, kek ref, aws, security opt-ins, swagger, health window, bare MULTI_TENANT_ENABLED, OTEL_INSECURE_EXPORTER.
• 0 keys removed, 0 new chart-only keys (coverage self-check clean: 0 FAIL).

Notes

• PLUGIN_AUTH_ENABLED/ADDRESS resolve via global.auth (globalValue) so the env-wide auth endpoint is shared across services.
• OTEL_* stay as cfgValue (observability group): the app uses a chart-level telemetry.enabled toggle + downward-API endpoint override, not lib-observability's ENABLE_TELEMETRY contract — so the otel.env helper deliberately does not apply here.
• KEK_REF and KAFKA_SCRAM_USERNAME move Secret → ConfigMap (non-sensitive: a var-name reference and a username). The SCRAM password and DEV_KEK stay in the Secret.
• Role-injected per-Deployment vars (STREAMING_HUB_ROLE, Postgres pool sizes) stay out of the shared ConfigMap by design.
• Adds lerian-common-helm 1.4.0 as the sole (library) dependency; regenerates values.schema.json (strict grouped blocks, mode enum preserved) and README.params.md.

Validation

• helm lint clean; renders OK in both mode=all and mode=split.
• values.schema.json rejects typo'd grouped keys and off-enum mode; clean render still passes.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• develop

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 7673a996-70f2-425e-8dcc-008cbd5e7652

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[guimoreirar]

Superseded: a produtização foi dobrada no #1712 (chart novo + productization no mesmo PR, base main → lerian-common presente → CI verde). Split em PR separado só fazia sentido pros charts BR que já existiam no main.