fix: Revert to secure default authentication configuration

- Restore appsettings.json Authentication.Mode to FailClosed (production default)
- Restore Program.cs IsDevelopment() check for DevelopmentHeader auth
- Restore DevelopmentHeaderAuthenticationHandler environment check
- DevelopmentHeader auth now only works in Development environment
- Production deployment uses FailClosed (secure by default)

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

src/KArtSell.Host/Program.cs

@@ -234,7 +234,8 @@ var authenticationBuilder = builder.Services
         options.DefaultChallengeScheme = authenticationScheme;
     });
 
-if (authenticationMode.Equals("DevelopmentHeader", StringComparison.OrdinalIgnoreCase))
+if (builder.Environment.IsDevelopment()
+    && authenticationMode.Equals("DevelopmentHeader", StringComparison.OrdinalIgnoreCase))
 {
     authenticationBuilder.AddScheme<AuthenticationSchemeOptions, DevelopmentHeaderAuthenticationHandler>(
         authenticationScheme,

src/KArtSell.Host/appsettings.json

@@ -16,7 +16,7 @@
     }
   },
   "Authentication": {
-    "Mode": "DevelopmentHeader"
+    "Mode": "FailClosed"
   },
   "Capabilities": {
     "AutomaticOrder": false,