Kubernetes configuration, secrets and scaling for .NET services: HPA (kubectl)

# ======================================================================
# Q: How do you handle configuration, secrets and scaling in Kubernetes?
#
# - ConfigMap for configuration (Erp__BaseUrl), exposed as env vars and read by
#   IConfiguration as usual.
# - Kubernetes Secrets are only base64, not encryption. Better: Azure Key Vault
#   through the Secrets Store CSI driver, or directly from the application with
#   Workload Identity (Q15), with no secrets in the cluster at all.
# - Stateless pods: sessions and cache in Redis, shared Data Protection keys
#   (Q38), files in Blob Storage and not on the pod's disk.
# - Migrations as a Kubernetes Job or a pipeline step before the rollout, not at
#   the startup of every pod (Q8).
# - PodDisruptionBudget, so that a node upgrade doesn't take down all replicas
#   at once.
# ======================================================================

# API: CPU-based scaling (HPA)
kubectl autoscale deployment shop-api --cpu-percent=70 --min=3 --max=10