feat: establish dotnet engineering foundation

Tiku.Api/Program.cs

@@ -17,6 +17,7 @@ using Tiku.Api.Security;
 using Tiku.Application;
 using Tiku.Application.Security;
 using Tiku.Infrastructure;
+using Tiku.Infrastructure.Commerce;
 using Tiku.Infrastructure.Persistence;
 using Tiku.Infrastructure.Storage;
 
@@ -133,10 +134,9 @@ try
         });
     }
 
-    var connectionString =
-        builder.Configuration.GetConnectionString("Database") ??
-        builder.Configuration["DATABASE_URL"] ??
-        "Host=localhost;Database=tiku;Username=postgres";
+    var connectionString = OptionsValidation.ResolveDatabaseConnectionString(
+        builder.Configuration,
+        builder.Environment.IsDevelopment());
 
     builder.Services.AddInfrastructure(connectionString);
     builder.Services.Configure<ObjectStorageOptions>(
@@ -172,10 +172,28 @@ try
             ? useInternalEndpoint
             : options.UseInternalEndpoint;
     });
+    builder.Services.AddOptions<TenantSecretEncryptionOptions>()
+        .Bind(builder.Configuration.GetSection(TenantSecretEncryptionOptions.SectionName))
+        .PostConfigure(options =>
+        {
+            options.KeyId = builder.Configuration["TIKU_TENANT_SECRET_KEY_ID"] ?? options.KeyId;
+            options.MasterKey = builder.Configuration["TIKU_TENANT_SECRET_MASTER_KEY"] ?? options.MasterKey;
+        })
+        .Validate(
+            TenantSecretEncryptionOptions.BeValid,
+            "Tenant secret encryption requires a key ID and a base64-encoded 32-byte master key.")
+        .Validate(
+            options => !builder.Environment.IsProduction() ||
+                       !TenantSecretEncryptionOptions.IsDevelopmentDefault(options),
+            "Production tenant secret encryption cannot use the development master key.")
+        .ValidateOnStart();
 
     builder.Services.AddOptions<JwtOptions>()
         .Bind(builder.Configuration.GetSection("Security:Jwt"))
         .ValidateDataAnnotations()
+        .Validate(
+            options => OptionsValidation.BeValidJwtOptions(options, builder.Environment.IsProduction()),
+            "Production JWT signing key must be explicitly configured and cannot use the development key.")
         .ValidateOnStart();
     var jwtOptions = builder.Configuration
         .GetSection("Security:Jwt")