Keep secrets out of appsettings.json

appsettings.json is committed, so a connection string with a password in it is readable by everyone with repository access, forever.

• Development: use the Secret Manager (dotnet user-secrets set "Payments:ApiKey" "..."), which stores values outside the project folder.
• Production: use environment variables or a secret store such as Azure Key Vault or AWS Secrets Manager, added as a configuration provider.
• Prefer managed identities over passwords where your platform supports them.

Environment variables use __ (double underscore) as the section separator: Payments__ApiKey binds to Payments:ApiKey on every platform.