E25 Phase 4: Program.cs conditional DI routing validation for secret modes

[holgerimbery]

Context\nSecret handling now spans Database and Single-Vault in core, and Multi-Vault in enterprise.\n\n## Goal\nVerify and harden Program.cs / service-registration routing paths so each runtime mode resolves the intended secret service deterministically.\n\n## Scope\n- Validate core host registrations route correctly for Database and Single-Vault modes.\n- Ensure no enterprise-specific routing leaks into core behavior.\n- Add verification checklist and smoke-test evidence for mode switching.\n\n## Acceptance Criteria\n- Core mode resolves DatabaseSecretService when UseKeyVaultForSecrets=false.\n- Core mode resolves AzureKeyVaultSecretService when UseKeyVaultForSecrets=true and KeyVaultUri is configured.\n- Misconfiguration fails safe with clear diagnostics.\n- Enterprise/multi-vault behavior remains isolated from core defaults.\n

[holgerimbery]

Keeping this open pending Phase 4 validation evidence.

What appears implemented:

• Secret service routing and Key Vault mode options are present in code/config paths.

What is still needed before close:

• Explicit Program.cs/DI routing validation evidence for each relevant secret mode.
• Misconfiguration/fail-safe verification (expected behavior when required config values are missing or inconsistent).
• Attached test/log evidence in this issue.

Once this validation evidence is added, this issue can be closed.