DB credentials should be replaced with Kubernetes secrets

[chandrams]

Database credentials are stored directly in values.yaml and rendered into a ConfigMap/env vars; consider switching these to Kubernetes Secrets (and templated Secret references) so that sensitive values are not committed or exposed in plain text.