## What this PR does
I added an offline render check for application charts because
helm-unittest suites can leave templates outside their `templates:`
lists unchecked. It runs in `make unit-tests` with fixtures for fresh,
configured and wildcard certificate states.
The fixtures cover injected cluster and namespace values, with checks
for PostgreSQL scheduling, tenant OIDC groups, shared services and
Harbor certificate settings. The two charts that require instance-type
lookup are skipped only while every fixture fails with the expected
lookup error.
I also added ClickHouse tests for generating the backup API password and
preserving an existing one. The render check uses empty lookup results
and checks YAML rendering only.
Closes https://github.com/cozystack/cozystack/issues/4057
### Validation
I ran `make unit-tests` and `make test-controllers`. All 16
render-matrix tests passed under bats and the shell runner with dash.
Deliberately broken rendering, fixture validation and password
generation or reuse made the tests fail.
### Downstream repositories
- [x] No downstream repository is affected by this change
### Release note
```release-note
NONE
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added automated validation that charts render successfully across
fresh, configured, and wildcard cluster states, including checks for
conditional resources and scheduling settings.
* Added coverage confirming ClickHouse backup API passwords are retained
when a Secret already exists.
* Expanded checks for invalid fixtures, skipped charts, and consistent
rendered output.
* **Documentation**
* Documented the render scenarios and how fixture values represent
cluster configuration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Aleksei Sviridkin
29932ddbb0