fix: audit 89 bugs - critical fixes

CRITICAL:
- JwtMiddleware orden (antes de UseAuthentication)
- JWT Secret en appsettings.json (no vacio)
- Transbank MySQL connection string (User=root + placeholder)
- package-lock generado + Dockerfile usa npm install
- Tests E2E: selectores corregidos con name attributes
- Tests: rut invalido reemplazado, casos sin auth
- Contacto page: apunta a services-externos (no backend)
- .env.example: credenciales reales -> placeholders

HIGH:
- extra_hosts agregado a services-externos en compose
- Dockerfile frontend: npm ci -> npm install

backend/src/Ventas.API/Program.cs

@@ -90,9 +90,9 @@ if (app.Environment.IsDevelopment())
 }
 
 app.UseCors();
+app.UseMiddleware<Ventas.API.Middleware.JwtMiddleware>();
 app.UseAuthentication();
 app.UseAuthorization();
-app.UseMiddleware<Ventas.API.Middleware.JwtMiddleware>();
 app.MapControllers();
 
 app.Run();

backend/src/Ventas.API/appsettings.json

@@ -10,6 +10,7 @@
     "Default": "Host=192.168.0.254;Port=5432;Database=ichn;Username=postgres;Password=apoca11;Pooling=true;Maximum Pool Size=100;"
   },
   "Jwt": {
+    "Secret": "CHANGE-ME-use-a-secure-key-with-at-least-32-chars",
     "ExpirationMinutes": 30
   }
 }