DEBT-013: Remove plaintext credentials from appsettings

High Impact / Low Effort security hardening: removes plaintext database
password and API keys from appsettings.json and appsettings.Development.json.

Credential strings replaced with empty values; schema/structure retained.
Users must provide credentials via environment variables:
  - KARTSELL_POSTGRES: database connection string
  - KRX_OPENAPI: Korea Exchange API key (read from Gitea Secrets in CI)
  - OPENDART_API: OpenDart API key (read from Gitea Secrets in CI)
  - KIS_APP_KEY, KIS_APP_SECRET: Korea Investment & Securities (read from Gitea Secrets in CI)

See CLAUDE.md Quick Start section for setup instructions.

Verification: dotnet build src/KArtSell.Host/KArtSell.Host.csproj -c Release
  0 warnings, 0 errors, builds successfully.

TECH_DEBT_REGISTER.md: DEBT-013 status updated from Deferred to Completed.

AGENTS.md compliance: #8 (Guardrails — credentials removed per security principle),
#12 (Right Way — security-first approach), #13 (Tech Debt — debt paydown 20%+ quarterly).

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

TECH_DEBT_REGISTER.md

@@ -10,9 +10,9 @@
 |--------|-------|--------------|
 | Backlog | 4 | 7 pts |
 | In Progress | 0 | 0 pts |
-| Completed | 6 | 14 pts |
+| Completed | 7 | 17 pts |
 | No Action | 1 | 1 pt |
-| Deferred | 5 | 7 pts |
+| Deferred | 4 | 4 pts |
 | Accepted | 1 | 2 pts |
 | Ready for Impl | 2 | 5 pts |
 
@@ -39,7 +39,7 @@
 | DEBT-010 | Model prediction logic | High (3) | High (3) | Backlog | ReplayEngine.cs:90,163 predict fixed quantities (100 units). Need actual position-sizing algorithm. Required for realistic cost simulation. Gate 3 uses fixed quantities; full implementation deferred. | @claude | Gate 3 Rehearsal Scope |
 | DEBT-011 | Cost 2x simulation | High (3) | High (3) | Backlog | ShadowRunJob.cs:132 uses linear approximation (TotalReturn * 0.5m). Need full re-simulation with actual fee/slippage impact. Required for realistic scenario analysis. Gate 3 uses linear model; full implementation deferred. | @claude | Gate 3 Rehearsal Scope |
 | DEBT-012 | False-exit analysis | High (3) | High (3) | Backlog | ShadowRunJob.cs:136-139, FalseExitAnalyzer.cs always returns 0. Unimplemented feature. Required for accurate sell-reason attribution. Gate 3 rehearsal does not include false-exit analysis; deferred to separate work. | @claude | Gate 3 Rehearsal Scope |
-| DEBT-013 | Credentials in appsettings | High (3) | Low (1) | Deferred | Host/tests appsettings.json contains plaintext DB password. Deferred: not in v16.0 scope. Revisit if security compliance requirements change. | @claude | Deferred |
+| DEBT-013 | Credentials in appsettings | High (3) | Low (1) | Completed | ✅ **Fixed 2026-08-14:** Removed plaintext credentials (DB password, API keys) from appsettings.json and appsettings.Development.json. Credential strings replaced with empty values; schema retained for environment-variable override. Users must provide KARTSELL_POSTGRES, KRX_OPENAPI, OPENDART_API, KIS_APP_KEY via environment (see CLAUDE.md Quick Start). dotnet build -c Release: 0 warnings, 0 errors post-fix. | @claude | Commit 31b36ba session 2026-08-14 |
 | DEBT-014 | Duplicate & reconciliation tracking | Medium (2) | Medium (2) | Ready for Implementation | ✅ **Implementation Guide Created (2026-08-11):** `DEBT-014-DEBT-029-IMPLEMENTATION-GUIDE.md` documents all steps: (1) Create `compliance.operation_audit_trail` migration, (2) Hook OutboxPollerJob to log duplicates, (3) Implement MetricsSql queries. SQL schema + C# code examples provided. Success criteria specified. Unblocked for PR. | @claude | Observability Enhancement |
 | DEBT-015 | Hangfire distributed lock timeout resilience | Medium (2) | High (3) | Completed | Applied consistent try/catch(Timeout) guard to all 6 Hangfire RecurringJob registrations: line 216 (RegisterModelOperationsSchedules), 260 (OpenDartDaily), 267 (DailyRecommendation), 273 (WeeklyRecommendation), 279 (MonthlyRecommendation). Prevents silent infinite wait; logs WARN and continues if lock times out. Resolves Host startup hangs when Hangfire schema initialization contentions occur. | @claude | PR Session commit 8b1c2f1 |
 

src/KArtSell.Host/appsettings.Development.json

@@ -3,6 +3,6 @@
     "Mode": "DevelopmentHeader"
   },
   "ConnectionStrings": {
-    "Postgres": "Host=127.0.0.1;Port=5432;Database=kartselldb;Username=kartsell;Password=kartsell4321@!"
+    "Postgres": ""
   }
 }

src/KArtSell.Host/appsettings.json

@@ -7,20 +7,20 @@
     }
   },
   "ConnectionStrings": {
-    "Postgres": "Host=127.0.0.1;Port=5432;Database=kartselldb;Username=kartsell;Password=kartsell4321@!"
+    "Postgres": ""
   },
   "ExternalApis": {
     "KrxOpenApi": {
-      "ApiKey": "FB391C96F128419AAFB193AB73DD6B8263E0D021",
+      "ApiKey": "",
       "BaseUrl": "https://openapi.krx.co.kr"
     },
     "OpenDart": {
-      "ApiKey": "75fa723edaf910cdb5e5412fb970333f2a334c63 ",
+      "ApiKey": "",
       "BaseUrl": "https://opendart.fss.or.kr"
     },
     "Kis": {
-      "ApiKey": "PSO3IbfKGVzArif97sdLhtfHZUo0wE7qLx8R",
-	  "ApiSecret": "0BD6sP51aB5pf3CXZLGXM1reyE1CWokwPuUOUR6zXve224OXHse9V1thvziQLIyGlQxNeWkshu6mo4WadZOODd1Iw+gN8cxbxnyf4jLIOuJc43jbwAP3SCIoX74WYMQUZCdnq2RJGcdux8JTXMzozh8zIMJKOc2B51qa+jiRNdKIItLBuJA=",
+      "ApiKey": "",
+      "ApiSecret": "",
       "BaseUrl": "https://openapi.kbsec.com"
     }
   },