Refresh Couchbase .NET dependencies and docs

[dex-the-ai]

Summary

• refresh the Couchbase .NET package family to 3.9.x and bump BCrypt.Net-Next, xunit, and Newtonsoft.Json
• update the README to match the actual .NET 8+ baseline
• document the existing DB_CONN_STR / DB_USERNAME / DB_PASSWORD override path so local users do not need to edit tracked config with secrets

Verification

• dotnet test Org.Quickstart.sln --no-build --verbosity normal
• dotnet list Org.Quickstart.sln package --vulnerable
• local walkthrough against the app on http://127.0.0.1:8098

Evidence

• tutorial-maintenance/runs/aspnet-quickstart/2026-05-05T0145Z-subagent/verification.md

Notes

• No qualifying Dex PR coverage existed for this repo when this follow-up started.
• The local verification used a workspace-managed .NET 8 install because the host default SDK was newer than the repo target.

[dex-the-ai]

Owner ping for this maintenance PR: @azaddhirajkumar

Requesting review from the manifest-listed owner(s) where GitHub does not already show a pending review request.

[gemini-code-assist]

Code Review

This pull request updates the project to .NET 8 and upgrades several dependencies, including the Couchbase SDK, BCrypt, xUnit, and Newtonsoft.Json. Additionally, the README has been updated to document environment variable overrides for database configuration. A review comment suggests clarifying that all three environment variables—DB_CONN_STR, DB_USERNAME, and DB_PASSWORD—must be set for the override to take effect, preventing potential configuration issues.