feat: Add hsm helm config

[DaevMithran]

Context

• relates to interledger/merchant-api#168

Adds the Helm configuration required to deploy the Test Wallet issuer and merchant HSM adapters from the hsm-server branch.

The adapters and Atalla connection use cleartext communication within the cluster. HSM support remains disabled by default so existing deployments are unaffected.

Changes

• Adds Helm values for the HSM role and Atalla connection.
• Sets ATALLA_TLS_ENABLED=false.
• Configures both adapters to listen on 0.0.0.0.
• Exposes the issuer adapter on port 50051.
• Exposes the merchant adapter on port 50052.
• Adds both ports to the backend Kubernetes Service.
• Documents the HSM deployment configuration.

[Copilot]

Copilot review overview

🟡 Changes recommended

The added block duplicates the existing config.backend.hsm key and the new contentMap entries contradict the documented HSM rendering design, causing empty ATALLA_HOST/ATALLA_PORT that crash the backend and break the existing helm unittest.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Duplicate backend.hsm key overrides the valid config block · New
• Example uses backend.hsm field names the template ignores · New

What changed in this PR

This PR adds Helm configuration to the testnet-wallet chart so the wallet backend can optionally host the issuer and merchant Atalla HSM gRPC adapters (from the hsm-server branch) in cleartext within the cluster, disabled by default. It wires up gRPC container/Service ports and documents the deployment configuration. The intent fits the chart's existing (already-present) HSM scaffolding (config.backend.hsm at values.yaml:215‑241, templates/configMap.backend.yaml, and the tests/).

Changes:

• Adds a second config.backend.hsm block plus HSM/Atalla entries to configMaps.backend.contentMap.
• Exposes gRPC ports 50051 (issuer) and 50052 (merchant) on the backend container and Kubernetes Service.
• Documents the HSM deployment under a new "Atalla HSM adapters" README section.

File	Description
helm/​testnet-wallet/​values.yaml	Adds a duplicate config.backend.hsm block (conflicting key names), new contentMap HSM keys, and issuer/merchant gRPC ports on the backend deployment and Service.
helm/​testnet-wallet/​README.md	Adds an "Atalla HSM adapters" section documenting the HSM config and notes backend HTTP/adapter ports.

Note on Helm compatibility (per repo guidance): the newly surfaced env vars (HSM_ENABLED, HSM_SERVER_ROLE, HSM_GRPC_HOST, ISSUER_GRPC_PORT, MERCHANT_GRPC_PORT, ATALLA_*) are read by the backend (packages/wallet/backend/src/config/env.ts). They are already served by the existing config.backend.hsm block + templates/configMap.backend.yaml; the new contentMap entries conflict with that mechanism rather than complementing it.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

🎉 This PR is included in version 1.1.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀