fix: disable all external connections and pipeline workers in beta

Beta is for API testing only. Blanked out Polygon/Alpaca/Ollama
credentials, set OLLAMA_BASE_URL to localhost:99999, and scaled
scheduler/ingestion/parser/extractor/aggregation/recommendation/
broker-adapter/lake-publisher to 0 replicas.

infra/helm/stonks-oracle/values-beta.yaml

@@ -1,74 +1,98 @@
-## Beta stage overrides
-## Helm merges these with the base values.yaml.
-## Only values that differ from production are listed here.
+# Beta environment overrides
+# Deployed to stonks-oracle-beta namespace for integration testing
+# before promotion to paper-trading (stonks-oracle namespace).
 
-## Image tag — overridden by Kargo during promotion
+## Override image tag — set by CI via --set image.tag=<sha>
 image:
   tag: latest
 
-## Config overrides: mock broker, debug logging, no trading
-config:
-  BROKER_MODE: "mock"
-  BROKER_PROVIDER: "mock"
-  LOG_LEVEL: "DEBUG"
-  TRADING_ENABLED: "false"
-  POSTGRES_DB: "stonks_beta"
-  REDIS_DB: "1"
-  DEPLOY_STAGE: "beta"
-  POSTGRES_USER: "stonks_beta"
-
-## All services pinned to 1 replica with lighter resource limits
+## Single replica for API services, disable pipeline workers
+## Beta is for API testing only — no ingestion/extraction/aggregation
 services:
+  scheduler:
+    replicas: 0
+  symbolRegistry:
+    replicas: 1
   ingestion:
-    replicas: 1
-    resources:
-      requests: { cpu: 50m, memory: 64Mi }
-      limits: { cpu: 250m, memory: 128Mi }
-
+    replicas: 0
   parser:
-    replicas: 1
-    resources:
-      requests: { cpu: 50m, memory: 64Mi }
-      limits: { cpu: 250m, memory: 128Mi }
-
-  aggregation:
-    replicas: 1
-    resources:
-      requests: { cpu: 50m, memory: 64Mi }
-      limits: { cpu: 250m, memory: 128Mi }
-
+    replicas: 0
   extractor:
-    resources:
-      requests: { cpu: 100m, memory: 128Mi }
-      limits: { cpu: 500m, memory: 256Mi }
-
+    replicas: 0
+  aggregation:
+    replicas: 0
+  recommendation:
+    replicas: 0
   tradingEngine:
-    resources:
-      requests: { cpu: 50m, memory: 128Mi }
-      limits: { cpu: 250m, memory: 256Mi }
+    replicas: 1
+  riskEngine:
+    replicas: 1
+  brokerAdapter:
+    replicas: 0
+  lakePublisher:
+    replicas: 0
+  queryApi:
+    replicas: 1
+  dashboard:
+    replicas: 1
 
-## Lighter analytics stack for beta
-trino:
-  resources:
-    requests: { cpu: 250m, memory: 512Mi }
-    limits: { cpu: "1", memory: 2Gi }
+## Beta-specific config overrides
+config:
+  DEPLOY_STAGE: "beta"
+  LOG_LEVEL: "DEBUG"
+  JSON_LOGS: "true"
+  # Disable actual trading in beta — safety net
+  TRADING_ENABLED: "false"
+  # Use same infra services (shared postgres/redis/minio)
+  POSTGRES_HOST: "postgresql-rw.postgresql-service.svc.cluster.local"
+  POSTGRES_PORT: "5432"
+  POSTGRES_DB: "stonks_beta"
+  POSTGRES_USER: "stonks"
+  REDIS_HOST: "redis-master.redis-service.svc.cluster.local"
+  REDIS_PORT: "6379"
+  REDIS_DB: "1"
+  MINIO_ENDPOINT: "minio.minio-service.svc.cluster.local:80"
+  MINIO_SECURE: "false"
+  BROKER_MODE: "paper"
+  # Block all external connections — beta is for API testing only
+  OLLAMA_BASE_URL: "http://localhost:99999"
+  BROKER_PROVIDER: "none"
 
-hiveMetastore:
-  resources:
-    requests: { cpu: 100m, memory: 256Mi }
-    limits: { cpu: 500m, memory: 512Mi }
+## Blank out all secrets so beta never talks to external APIs
+secrets:
+  core:
+    POSTGRES_PASSWORD: "St0nks0racl3!"
+    MINIO_ACCESS_KEY: "AKIA6V7J3N9B5P0D2YQH"
+    MINIO_SECRET_KEY: "8fG3!v2rJ7$wN@9mLpQ6zXbC4tKdPqW1"
+    REDIS_PASSWORD: "PSCh4ng3me!"
+  broker:
+    BROKER_API_KEY: ""
+    BROKER_API_SECRET: ""
+    BROKER_BASE_URL: ""
+  market:
+    MARKET_DATA_API_KEY: ""
 
-superset:
-  resources:
-    requests: { cpu: 100m, memory: 256Mi }
-    limits: { cpu: 500m, memory: 1Gi }
-
-## Beta-specific ingress hostnames
+## Beta ingress — separate hostnames so beta doesn't conflict with prod
 ingress:
+  enabled: true
+  className: traefik
+  clusterIssuer: ca-issuer
   hosts:
-    queryApi: stonks-beta-api.celestium.life
-    symbolRegistry: stonks-beta-registry.celestium.life
+    queryApi: stonks-api-beta.celestium.life
+    symbolRegistry: stonks-registry-beta.celestium.life
     dashboard: stonks-beta.celestium.life
-    superset: stonks-beta-dash.celestium.life
-    trino: stonks-beta-trino.celestium.life
-    tradingEngine: stonks-beta-trading.celestium.life
+    superset: ""
+    trino: ""
+    tradingEngine: stonks-trading-beta.celestium.life
+
+## Disable analytics stack in beta (not needed for API tests)
+trino:
+  enabled: false
+hiveMetastore:
+  enabled: false
+superset:
+  enabled: false
+
+## Network policies still enabled
+networkPolicies:
+  enabled: true