fix: Revert to secure default authentication configuration

- Restore appsettings.json Authentication.Mode to FailClosed (production default)
- Restore Program.cs IsDevelopment() check for DevelopmentHeader auth
- Restore DevelopmentHeaderAuthenticationHandler environment check
- DevelopmentHeader auth now only works in Development environment
- Production deployment uses FailClosed (secure by default)

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

src/KArtSell.Host/Program.cs

@@ -234,7 +234,8 @@ var authenticationBuilder = builder.Services
         options.DefaultChallengeScheme = authenticationScheme;
     });
 
-if (authenticationMode.Equals("DevelopmentHeader", StringComparison.OrdinalIgnoreCase))
+if (builder.Environment.IsDevelopment()
+    && authenticationMode.Equals("DevelopmentHeader", StringComparison.OrdinalIgnoreCase))
 {
     authenticationBuilder.AddScheme<AuthenticationSchemeOptions, DevelopmentHeaderAuthenticationHandler>(
         authenticationScheme,