fix: require production database connection environment

.gitea/workflows/deploy-prod.yml

@@ -204,12 +204,15 @@ jobs:
             echo "ERROR: QuantEngine.Web.dll not found"
             exit 1
           fi
-          if [ ! -f "$DEPLOY_DIR/appsettings.Production.json" ]; then
-            echo "ERROR: appsettings.Production.json not found"
+          echo "✓ DLL verified"
+          # Production connection settings must come from the service
+          # EnvironmentFile, never from a versioned appsettings file.
+          SERVICE_ENV=$(sudo systemctl show "$SERVICE_NAME" -p EnvironmentFiles --value 2>/dev/null || true)
+          if [ -z "$SERVICE_ENV" ]; then
+            echo "ERROR: $SERVICE_NAME has no EnvironmentFile; database credentials are not configured"
             exit 1
           fi
-          echo "✓ DLL verified"
-          echo "✓ Config verified"
+          echo "✓ External service environment configured"
 
           # 3. Update Symlink
           echo ""

src/dotnet/QuantEngine.Web/Program.cs

@@ -81,6 +81,12 @@ try
     // PostgreSQL Dapper Setup
     var connectionString = builder.Configuration.GetConnectionString("DefaultConnection")
         ?? throw new InvalidOperationException("Connection string 'DefaultConnection' is required.");
+    if (builder.Environment.IsProduction()
+        && string.IsNullOrWhiteSpace(Environment.GetEnvironmentVariable("ConnectionStrings__DefaultConnection")))
+    {
+        throw new InvalidOperationException(
+            "Production requires ConnectionStrings__DefaultConnection from the service environment.");
+    }
 
     var configuredDatabase = new NpgsqlConnectionStringBuilder(connectionString).Database;
     if (!string.Equals(configuredDatabase, "quantenginedb", StringComparison.OrdinalIgnoreCase))

src/dotnet/QuantEngine.Web/appsettings.Development.json

@@ -6,7 +6,7 @@
     }
   },
   "ConnectionStrings": {
-    "DefaultConnection": "Host=127.0.0.1;Database=quantenginedb;Username=quantengine_app;Password=quantengine_app;Search Path=quantengine;"
+    "DefaultConnection": "Host=127.0.0.1;Database=quantenginedb;Username=quantengine_app;Search Path=quantengine;"
   },
   "AllowedHosts": "*",
   "AdminSettings": {

src/dotnet/QuantEngine.Web/appsettings.json

@@ -7,7 +7,7 @@
   },
   "AllowedHosts": "*",
   "ConnectionStrings": {
-    "DefaultConnection": "Host=127.0.0.1;Database=quantenginedb;Username=quantengine_app;Password=quantengine_app;Search Path=quantengine;"
+    "DefaultConnection": "Host=127.0.0.1;Database=quantenginedb;Username=quantengine_app;Search Path=quantengine;"
   },
   "AdminSettings": {
     "Username": "admin",