Revert "Merge pull request 'Dev' (#58) from Dev into production"

This reverts commit 821e96e011, reversing changes made to 0ff39e9e58.
2026-09-17 11:25:33 +05:30
parent efb37fce7a
commit 256e39ccff
52 changed files with 87 additions and 2224 deletions
@@ -247,8 +247,14 @@ Resulting `ERPCore.csproj`:
  "Jwt": { "SigningKey": "dev-only-signing-key-please-change-me-0123456789" }
 }
 ```
-The deployed environment (production; a test environment is on hold) has **no** `appsettings.<Environment>.json`: every environment-specific value and secret is an environment variable in `/etc/erpcore/erpcore.env`, and outside Development the API refuses to start when a required key is blank — see `40-DEPLOYMENT.md §5`.
-> **Secrets note:** `appsettings.Development.json` is git-ignored (start from `appsettings.Development.json.example`) and the base `appsettings.json` holds no secrets. Credentials committed before this change stay readable in git history and must be rotated (`02-SECURITY.md` AR-06).
+`appsettings.Production.json` (values injected from environment variables at deploy time):
+```json
+{
+  "ConnectionStrings": { "DefaultConnection": "" },
+  "Jwt": { "SigningKey": "" }
+}
+```
+> **Secrets note (current phase):** we are on **localhost dev only**, so the Development file holds local credentials for convenience. Before any shared/staging/production use, move secrets to **User Secrets** (dev) and **environment variables** (prod), keep `appsettings.Development.json` / `appsettings.Production.json` out of git (see root `.gitignore`), and rotate any credential that was ever committed.

 ### 5.6 Minimal `Program.cs` wiring (outline)
 ```csharp