F5: Add startup validation guard for missing/invalid AzureAd configuration (fail-fast hardening)

## Security Hardening: F5 — No Startup Guard on AzureAd Config

**Severity:** Hardening
**Source:** Winter Soldier security review of PR #828 (DEF-001 auth fix)
**Traceability:** Follow-on from #822 (DEF-001) · Related PR: #828

---

### Summary

The application currently starts without validating required `AzureAd` configuration values (e.g. `ClientId`, `TenantId`, `ClientSecret`). A missing or blank `ClientId` can cause the app to either:

- **Fail open** — serve requests without enforcing authentication, or
- **Silently reject all requests** — producing cryptic runtime errors with no clear root cause.

Neither behaviour is acceptable for a DoD RMF product. The app must refuse to start if its auth configuration is incomplete.

---

### Required Change

Add a startup validation guard (e.g. in `Program.cs` / `Startup.cs` or the host builder pipeline) that:

1. Reads all required `AzureAd` config keys (`ClientId`, `TenantId`, `Instance`, and any other required values).
2. Asserts each is non-null and non-empty.
3. Throws a descriptive `InvalidOperationException` (or equivalent) at startup — **before** any requests are served — if validation fails.
4. Logs a clear, actionable error message naming the missing key(s).

This follows the **fail-fast** principle: a misconfigured auth stack should never silently degrade.

---

### Acceptance Criteria

- [ ] Startup guard implemented and executes before the HTTP pipeline is initialized.
- [ ] Missing `ClientId` causes immediate startup failure with a descriptive error.
- [ ] Missing `TenantId` causes immediate startup failure with a descriptive error.
- [ ] Existing valid-config startup path is unaffected (no regression).
- [ ] Unit/integration test added covering the missing-config failure path.

---

### References

- DEF-001 record: #822
- Auth fix PR: #828

> **This issue is non-blocking for merging PR #828 and is a hardening follow-on item.**

Start in Program.cs, Startup.cs, or the host builder pipeline and trace where AzureAd configuration is loaded before the HTTP pipeline starts. Review the existing auth setup and add a unit or integration test for missing configuration; done means missing required keys fail startup descriptively while valid configuration still starts.

Written by the indexing model from the issue text.