[Bpoe]

Indirection now loads optional /run/secrets files through Microsoft's built-in Key-Per-File provider after WebApplication.CreateBuilder() and before service registration. For example, Authentication__ApiKey supplies Authentication:ApiKey; arbitrary hierarchical keys work the same way. Files override every standard source, including command-line arguments, while a missing directory preserves existing configuration behavior.

The registration uses the provider already included in the ASP.NET Core shared framework. No custom parsing, default credentials, secret logging, or reload behavior is introduced. README documentation covers mapping, precedence, optional deployment, and restart after rotation. Docker, Compose, CI, and release packaging are unchanged.

Validation:

• All 46 MSTest tests passed, including 8 new configuration cases covering mapping, precedence, absent directories, authentication option binding, and blank-key rejection; existing HTTP authentication tests also pass.
• Coverage: 99% lines and 100% branches; existing 96% thresholds are unchanged and pass.
• dotnet test --project src/test/Indirection.Tests -c Release --coverlet --coverlet-threshold 96 --coverlet-threshold-type line,branch --results-directory "$PWD/artifacts/coverage"
• dotnet build Indirection.sln -c Release --no-restore -m:1 passed with zero warnings and errors.
• git diff --check passed.