feat: externalize appsettings to K8s Secret — config persists independently of image rebuilds

- Add cms-config.yaml (K8s Secret) for staging and production
- Mount appsettings.{Environment}.json from Secret into /app/
- Update CI/CD pipelines to apply Secret before Deployment
- Remove redundant env vars (Kestrel, FileStorage) — now in config file

k8s/production/cms-deployment.yaml

@@ -45,13 +45,13 @@ spec:
           value: "Production"
         - name: ASPNETCORE_URLS
           value: "http://+:8080"
-        - name: Kestrel__EndpointDefaults__Protocols
-          value: "Http1AndHttp2"
-        - name: FileStorage__UploadPath
-          value: "/app/Uploads"
         volumeMounts:
         - name: cms-uploads
           mountPath: /app/Uploads
+        - name: cms-config
+          mountPath: /app/appsettings.Production.json
+          subPath: appsettings.Production.json
+          readOnly: true
         resources:
           requests:
             memory: "512Mi"
@@ -79,6 +79,9 @@ spec:
       - name: cms-uploads
         persistentVolumeClaim:
           claimName: cms-uploads-pvc
+      - name: cms-config
+        secret:
+          secretName: cms-appsettings
 
 ---
 # CMS Service (Production)