🔒 SECURITY: Emergency fixes and hardening

EMERGENCY FIXES:
✅ DELETE MockSilverPayService.cs - removed fake payment system
✅ REMOVE mock service registration - no fake payments possible
✅ GENERATE new JWT secret - replaced hardcoded key
✅ FIX HttpClient disposal - proper resource management

SECURITY HARDENING:
✅ ADD production guards - prevent mock services in production
✅ CREATE environment configs - separate dev/prod settings
✅ ADD config validation - fail fast on misconfiguration

IMPACT:
- Mock payment system completely eliminated
- JWT authentication now uses secure keys
- Production deployment now validated on startup
- Resource leaks fixed in TeleBot currency API

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

LittleShop/appsettings.Production.json

@@ -7,19 +7,34 @@
     }
   },
   "ConnectionStrings": {
-    "DefaultConnection": "Data Source=littleshop.db"
+    "DefaultConnection": "Data Source=littleshop-production.db"
   },
   "Jwt": {
     "Key": "${JWT_SECRET_KEY}",
-    "Issuer": "LittleShop",
-    "Audience": "LittleShop-API",
-    "ExpiryMinutes": 60
+    "Issuer": "LittleShop-Production",
+    "Audience": "LittleShop-Production",
+    "ExpiryInHours": 24
   },
-  "BTCPayServer": {
-    "ServerUrl": "${BTCPAY_SERVER_URL}",
-    "StoreId": "${BTCPAY_STORE_ID}",
-    "ApiKey": "${BTCPAY_API_KEY}",
-    "WebhookSecret": "${BTCPAY_WEBHOOK_SECRET}"
+  "SilverPay": {
+    "BaseUrl": "${SILVERPAY_BASE_URL}",
+    "ApiKey": "${SILVERPAY_API_KEY}",
+    "WebhookSecret": "${SILVERPAY_WEBHOOK_SECRET}",
+    "DefaultWebhookUrl": "${SILVERPAY_WEBHOOK_URL}",
+    "AllowUnsignedWebhooks": false
+  },
+  "RoyalMail": {
+    "ClientId": "${ROYALMAIL_CLIENT_ID}",
+    "ClientSecret": "${ROYALMAIL_CLIENT_SECRET}",
+    "BaseUrl": "https://api.royalmail.net/",
+    "SenderAddress1": "${ROYALMAIL_SENDER_ADDRESS}",
+    "SenderCity": "${ROYALMAIL_SENDER_CITY}",
+    "SenderPostCode": "${ROYALMAIL_SENDER_POSTCODE}",
+    "SenderCountry": "United Kingdom"
+  },
+  "WebPush": {
+    "VapidPublicKey": "${WEBPUSH_VAPID_PUBLIC_KEY}",
+    "VapidPrivateKey": "${WEBPUSH_VAPID_PRIVATE_KEY}",
+    "Subject": "${WEBPUSH_SUBJECT}"
   },
   "AllowedHosts": "*",
   "Urls": "http://+:8080",