DEBT-013: Remove plaintext credentials from appsettings

High Impact / Low Effort security hardening: removes plaintext database
password and API keys from appsettings.json and appsettings.Development.json.

Credential strings replaced with empty values; schema/structure retained.
Users must provide credentials via environment variables:
  - KARTSELL_POSTGRES: database connection string
  - KRX_OPENAPI: Korea Exchange API key (read from Gitea Secrets in CI)
  - OPENDART_API: OpenDart API key (read from Gitea Secrets in CI)
  - KIS_APP_KEY, KIS_APP_SECRET: Korea Investment & Securities (read from Gitea Secrets in CI)

See CLAUDE.md Quick Start section for setup instructions.

Verification: dotnet build src/KArtSell.Host/KArtSell.Host.csproj -c Release
  0 warnings, 0 errors, builds successfully.

TECH_DEBT_REGISTER.md: DEBT-013 status updated from Deferred to Completed.

AGENTS.md compliance: #8 (Guardrails — credentials removed per security principle),
#12 (Right Way — security-first approach), #13 (Tech Debt — debt paydown 20%+ quarterly).

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

src/KArtSell.Host/appsettings.Development.json

@@ -3,6 +3,6 @@
     "Mode": "DevelopmentHeader"
   },
   "ConnectionStrings": {
-    "Postgres": "Host=127.0.0.1;Port=5432;Database=kartselldb;Username=kartsell;Password=kartsell4321@!"
+    "Postgres": ""
   }
 }

src/KArtSell.Host/appsettings.json

@@ -7,20 +7,20 @@
     }
   },
   "ConnectionStrings": {
-    "Postgres": "Host=127.0.0.1;Port=5432;Database=kartselldb;Username=kartsell;Password=kartsell4321@!"
+    "Postgres": ""
   },
   "ExternalApis": {
     "KrxOpenApi": {
-      "ApiKey": "FB391C96F128419AAFB193AB73DD6B8263E0D021",
+      "ApiKey": "",
       "BaseUrl": "https://openapi.krx.co.kr"
     },
     "OpenDart": {
-      "ApiKey": "75fa723edaf910cdb5e5412fb970333f2a334c63 ",
+      "ApiKey": "",
       "BaseUrl": "https://opendart.fss.or.kr"
     },
     "Kis": {
-      "ApiKey": "PSO3IbfKGVzArif97sdLhtfHZUo0wE7qLx8R",
-	  "ApiSecret": "0BD6sP51aB5pf3CXZLGXM1reyE1CWokwPuUOUR6zXve224OXHse9V1thvziQLIyGlQxNeWkshu6mo4WadZOODd1Iw+gN8cxbxnyf4jLIOuJc43jbwAP3SCIoX74WYMQUZCdnq2RJGcdux8JTXMzozh8zIMJKOc2B51qa+jiRNdKIItLBuJA=",
+      "ApiKey": "",
+      "ApiSecret": "",
       "BaseUrl": "https://openapi.kbsec.com"
     }
   },