refactor: replace nuget update source with user-level NuGet.Config write

Instead of mutating the project-level nuget.config with backup/restore,
write a credentials-only XML to /root/.nuget/NuGet/NuGet.Config inside
the BuildKit secret mount. NuGet merges packageSourceCredentials from
the user-level config independently of <clear /> in packageSources, so
packageSourceMapping and source definitions in nuget.config are fully
preserved. The credentials file is removed at end of the same RUN layer.

Also fixes:
- ! -f → ! -s (fail-fast if secret is empty, not just missing)
- No more backup/restore dance or nuget.config mutation

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: BenjaminMichaelis

EssentialCSharp.Web/Dockerfile

@@ -19,20 +19,18 @@ WORKDIR /src
 COPY . .
 COPY --from=frontend-build /frontend/EssentialCSharp.Web/wwwroot/dist ./EssentialCSharp.Web/wwwroot/dist
 RUN --mount=type=secret,id=nuget_pat,required=false \
-    if [ "$ACCESS_TO_NUGET_FEED" = "true" ] && [ ! -f /run/secrets/nuget_pat ]; then \
-      echo "ERROR: ACCESS_TO_NUGET_FEED=true but nuget_pat secret is missing" >&2; exit 1; \
+    if [ "$ACCESS_TO_NUGET_FEED" = "true" ] && [ ! -s /run/secrets/nuget_pat ]; then \
+      echo "ERROR: ACCESS_TO_NUGET_FEED=true but nuget_pat secret is missing or empty" >&2; exit 1; \
     fi && \
-    cp nuget.config nuget.config.bak && \
     if [ "$ACCESS_TO_NUGET_FEED" = "true" ]; then \
-      dotnet nuget update source EssentialCSharp \
-        --username az \
-        --password "$(cat /run/secrets/nuget_pat)" \
-        --store-password-in-clear-text; \
+      mkdir -p /root/.nuget/NuGet && \
+      printf '<?xml version="1.0" encoding="utf-8"?>\n<configuration>\n  <packageSourceCredentials>\n    <EssentialCSharp>\n      <add key="Username" value="az" />\n      <add key="ClearTextPassword" value="%s" />\n    </EssentialCSharp>\n  </packageSourceCredentials>\n</configuration>\n' \
+        "$(cat /run/secrets/nuget_pat)" > /root/.nuget/NuGet/NuGet.Config; \
     fi && \
     dotnet restore "EssentialCSharp.Web.slnx" -p:AccessToNugetFeed=$ACCESS_TO_NUGET_FEED && \
     dotnet build "EssentialCSharp.Web.slnx" -c Release --no-restore -p:AccessToNugetFeed=$ACCESS_TO_NUGET_FEED -p:ReleaseDateAttribute=True -p:SkipFrontendBuild=true && \
     dotnet publish "EssentialCSharp.Web.slnx" -c Release -p:PublishDir=/app/publish -p:UseAppHost=false -p:SkipFrontendBuild=true --no-build && \
-    mv nuget.config.bak nuget.config
+    rm -f /root/.nuget/NuGet/NuGet.Config
 
 FROM base AS final
 WORKDIR /app