fix: Revert to secure default authentication configuration

- Restore appsettings.json Authentication.Mode to FailClosed (production default)
- Restore Program.cs IsDevelopment() check for DevelopmentHeader auth
- Restore DevelopmentHeaderAuthenticationHandler environment check
- DevelopmentHeader auth now only works in Development environment
- Production deployment uses FailClosed (secure by default)

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

src/KArtSell.Host/Program.cs

@@ -234,7 +234,8 @@ var authenticationBuilder = builder.Services
         options.DefaultChallengeScheme = authenticationScheme;
     });
 
-if (authenticationMode.Equals("DevelopmentHeader", StringComparison.OrdinalIgnoreCase))
+if (builder.Environment.IsDevelopment()
+    && authenticationMode.Equals("DevelopmentHeader", StringComparison.OrdinalIgnoreCase))
 {
     authenticationBuilder.AddScheme<AuthenticationSchemeOptions, DevelopmentHeaderAuthenticationHandler>(
         authenticationScheme,

src/KArtSell.Host/Security/DevelopmentHeaderAuthenticationHandler.cs

@@ -18,6 +18,12 @@ public sealed class DevelopmentHeaderAuthenticationHandler(
 {
     protected override Task<AuthenticateResult> HandleAuthenticateAsync()
     {
+        if (!environment.IsDevelopment())
+        {
+            return Task.FromResult(AuthenticateResult.Fail(
+                "Development header authentication is disabled outside Development."));
+        }
+
         var user = Request.Headers["X-KArtSell-User"].ToString();
         var role = Request.Headers["X-KArtSell-Role"].ToString();
         if (string.IsNullOrWhiteSpace(user) || string.IsNullOrWhiteSpace(role))

src/KArtSell.Host/appsettings.json

@@ -16,7 +16,7 @@
     }
   },
   "Authentication": {
-    "Mode": "DevelopmentHeader"
+    "Mode": "FailClosed"
   },
   "Capabilities": {
     "AutomaticOrder": false,