Remove the committed connection string default and load secrets from Key Vault

Tier 2 — configuration

Problem

appsettings.json ships a LocalDB connection string as the default. In production this is dead weight at best; at worst, if the environment variable is missing, the app starts and tries to reach a database that does not exist rather than failing loudly with a clear message.

Evidence

• LearnStack/appsettings.json:2-4
• LearnStack/Program.cs:32-33 — throws only when the value is entirely absent

Proposed fix

1. Remove the default from appsettings.json; keep it in appsettings.Development.json or user secrets only.
2. Source the production connection string from Key Vault via managed identity, or use a passwordless Azure SQL connection with managed identity.
3. Fail fast at startup with an actionable message when configuration is incomplete.

Acceptance criteria

• No connection string in source control
• Production connects with managed identity
• Missing configuration produces a clear startup error

Start with LearnStack/appsettings.json:2-4 and LearnStack/Program.cs:32-33 to trace how the connection string is currently loaded and validated. Then review the production configuration path for Key Vault or managed identity. Done means no connection string remains in source control, production uses managed identity, and incomplete configuration produces a clear startup error.