remove user-secrets approach & prepare a pilot deploy

server/src/API/Baya.Web.Api/appsettings.Development.json

@@ -1,11 +1,11 @@
 {
   "ConnectionStrings": {
     "SqlServer": "Server=87.107.152.16,1433;Database=Baya;User Id=hamid_root_un_sa;Password=N8@s5Taw1zWeh@#Hm;TrustServerCertificate=True;Encrypt=False;",
-    "logDb":"Server=87.107.152.16,1433;Database=Baya_Logs;User Id=hamid_root_un_sa;Password=N8@s5Taw1zWeh@#Hm;TrustServerCertificate=True;Encrypt=False;"
+    "logDb": "Server=87.107.152.16,1433;Database=Baya_Logs;User Id=hamid_root_un_sa;Password=N8@s5Taw1zWeh@#Hm;TrustServerCertificate=True;Encrypt=False;"
   },
   "IdentitySettings": {
-    "SecretKey": "SET_VIA_USER_SECRETS_OR_ENV",
-    "Encryptkey": "SET_VIA_USER_SECRETS_OR_ENV",
+    "SecretKey": "dev-only-jwe-signing-key-not-for-production-0123456789abcdef",
+    "Encryptkey": "dev-only-16bytes",
     "Issuer": "Balinyaar",
     "Audience": "BalinyaarClient",
     "NotBeforeMinutes": "0",
@@ -13,8 +13,9 @@
   },
   "Seams": {
     "FieldEncryption": {
-      "Key": "SET_VIA_USER_SECRETS_OR_ENV",
-      "HashKey": "SET_VIA_USER_SECRETS_OR_ENV"
+      "//": "DO NOT CHANGE. Every encrypted column in the Baya database (phones, addresses, IBANs, clinical notes) was written with these exact values, and users.PhoneHash — which every login looks up — is derived from HashKey. Rotating either makes the existing data unreadable and locks every account out.",
+      "Key": "local-dev-field-encryption-key-not-for-production",
+      "HashKey": "local-dev-field-hash-key-not-for-production"
     },
     "ObjectStorage": {
       "RootPath": ""
@@ -23,7 +24,8 @@
       "Provider": "telegram",
       "Telegram": {
         "BaseUrl": "http://127.0.0.1:5010",
-        "ApiKey": "ab8984974bc1fe5ce514d0fd74f71c8738b3aed92a7e4d86",
+        "//": "Must equal the relay's API_KEY. NOT the value in telegram-otp-bot/.env.example — that one is published, so TelegramSmsSender rejects it.",
+        "ApiKey": "6a8dfaeea1aa375eb61da7663cadf23a3ea245fd939264dd",
         "TimeoutSeconds": 10
       }
     },
@@ -34,11 +36,20 @@
     }
   },
   "Cors": {
-    "AllowedOrigins": []
+    "AllowedOrigins": [
+      "https://balinyaar.ir",
+      "https://www.balinyaar.ir",
+      "http://localhost:3000"
+    ]
   },
   "ForwardedHeaders": {
+    "//": "Docker bridge ranges — the reverse proxy (Caddy) shares a container network with the API, so its hop must be trusted for X-Forwarded-For to resolve the real client IP the rate limiter partitions on.",
     "KnownProxies": [],
-    "KnownNetworks": []
+    "KnownNetworks": [
+      "172.16.0.0/12",
+      "192.168.0.0/16",
+      "10.0.0.0/8"
+    ]
   },
   "AllowedHosts": "*",
   "Kestrel": {