Add deployment

VigilCareClinicalAPI/Configuration/KafkaOptions.cs

@@ -11,4 +11,11 @@ public class KafkaOptions
     public int MaxPoisonRetries { get; set; } = 5;
     public string NotificationPublisherGroupId { get; set; } = "notification-publisher";
     public string NotificationPublisherAutoOffsetReset { get; set; } = "Earliest";
+
+    /// <summary>Plaintext for local compose; SaslSsl (etc.) for production.</summary>
+    public string SecurityProtocol { get; set; } = "Plaintext";
+    public string? SaslMechanism { get; set; }
+    public string? SaslUsername { get; set; }
+    public string? SaslPassword { get; set; }
+    public string? SslCaLocation { get; set; }
 }

VigilCareClinicalAPI/Configuration/KafkaSecurityExtensions.cs

@@ -0,0 +1,29 @@
+using Confluent.Kafka;
+
+public static class KafkaSecurityExtensions
+{
+    /// <summary>
+    /// Applies the configured security protocol and SASL credentials to any
+    /// Confluent client config. Called by every producer, consumer, and admin
+    /// client so credentials are configured in exactly one place.
+    /// </summary>
+    public static T ApplySecurity<T>(this T config, KafkaOptions options)
+        where T : ClientConfig
+    {
+        if (Enum.TryParse<SecurityProtocol>(options.SecurityProtocol, true, out var protocol))
+            config.SecurityProtocol = protocol;
+
+        if (!string.IsNullOrWhiteSpace(options.SaslMechanism)
+            && Enum.TryParse<SaslMechanism>(options.SaslMechanism, true, out var mechanism))
+        {
+            config.SaslMechanism = mechanism;
+            config.SaslUsername = options.SaslUsername;
+            config.SaslPassword = options.SaslPassword;
+        }
+
+        if (!string.IsNullOrWhiteSpace(options.SslCaLocation))
+            config.SslCaLocation = options.SslCaLocation;
+
+        return config;
+    }
+}

VigilCareClinicalAPI/Configuration/RabbitMqOptions.cs

@@ -9,4 +9,10 @@ public sealed class RabbitMqOptions
     // Drives both the paging worker poll timeout and the DLQ x-message-ttl.
     // In production: 300000 (5 min). In tests: 5000 (5 sec).
     public int PagingAckTimeoutMs { get; init; } = 300000;
-}
+
+    /// <summary>
+    /// When true, enables TLS on the AMQP connection (typical production port 5671).
+    /// Local compose uses plaintext on 5674/5672 — leave false.
+    /// </summary>
+    public bool UseSsl { get; init; } = false;
+}