feat(grpc): PSK-authenticate the site gRPC control plane; drop the vestigial management receptionist registration

Phase 0 of the ClusterClient→gRPC migration
(docs/plans/2026-07-22-clusterclient-to-grpc-plan.md). Standalone hardening: it
closes a gap that exists today and is a precondition for moving command/control
onto gRPC in later phases.

T0.1 — delete the ManagementActor ClusterClientReceptionist registration.
It was built for an out-of-cluster CLI that was never written: the shipped CLI
speaks HTTP Basic to /management, which asks the actor in-process through
ManagementActorHolder. Nothing in the repo ever sent to /user/management. The
actor still runs there; only the cross-boundary advertisement is gone. Six
documents claimed the CLI used ClusterClient — including the CLI's own README
"Architecture Notes" — and are corrected here rather than left to rot.

T0.2 — record, do not port, the dead integration-routing path.
IntegrationCallRequest is unwired at BOTH ends: RouteIntegrationCallAsync has
zero callers anywhere, and RegisterLocalHandler(Integration, …) appears only in
a test, so production always answers "Integration handler not available". It is
excluded from the gRPC contract (28 of 29 commands migrate) rather than
enshrined on an additive-only wire format, and deleting it during a
transport migration would mix a behavioural change into a change whose whole
value is that behaviour is identical. See
docs/known-issues/2026-07-22-integration-call-routing-is-dead-code.md.

T0.3 — preshared-key authentication on SiteStreamService.
The service shipped with no auth at all: plaintext h2c, no interceptor, so
anything that could reach a site node's :8083 could open a live data stream or
read audit rows back via PullAuditEvents/PullSiteCalls. ControlPlaneAuthInterceptor
now gates /sitestream.SiteStreamService/ — modeled on LocalDbSyncAuthInterceptor
(constant-time compare, fail-closed, PermissionDenied) but gating a SET of
service prefixes so phases 1A/1B add services rather than interceptors. LocalDb
sync keeps its own separate key: it authenticates the pair partner, not central,
and collapsing the two would make a site's central-facing key also admit writes
into its database.

Keys are per site (SB-GRPC-PSK-<siteId>), never fleet-wide, so a compromised
site yields only its own. Central attaches them through ControlPlaneCredentials,
which binds CallCredentials to the channel — covering unary and streaming
uniformly, and letting the key resolve asynchronously, which a client
interceptor could not do without blocking. All three central→site channel
creation sites go through it (SiteStreamGrpcClient and both audit pull invokers);
the pull invokers' channel caches are re-keyed by (site, endpoint) because
credentials are per-site and bound to the channel.

Two decisions beyond the plan:

  * StartupValidator now requires GrpcPsk on Site nodes. The plan specified only
    the runtime gate, but fail-closed with no boot check produces a node that
    joins, answers heartbeats and reports healthy while refusing every stream,
    audit pull and telemetry ingest — silent and total. Same reasoning as the
    existing inbound API-key pepper rule.

  * Added Communication:SitePsks as a central-side key map. The plan assumed
    central would read the store, seeded via a dev KEK; the docker rig
    deliberately boots with no master key, so store-only resolution would leave
    it unable to dial its own sites. The store stays primary — it is the only
    source that can serve a site added at runtime — with the map covering
    key-less hosts and one-off pins. Neither source falling back to
    "unauthenticated" is the invariant.

T0.4 — dev keys on both rigs and tests.
34 tests. The seven that matter most exercise a real in-process gRPC stack over
TestServer: the unit tests on either side of the wire would both stay green if
the halves disagreed, and gRPC refuses call credentials on a plaintext channel
by default — the UnsafeUseInsecureChannelCallCredentials opt-in is only provable
by making a real call. They confirm correct key passes on unary AND streaming,
wrong key and no-credentials both get PermissionDenied, and an unresolvable key
fails the call with nothing reaching the service.

OPERATIONAL: a site node upgraded to this build without a key will not boot.
That includes the gitignored deploy/wonder-app-vd03/ overlay.

src/ZB.MOM.WW.ScadaBridge.Host/ControlPlaneAuthInterceptor.cs

@@ -0,0 +1,211 @@
+using System.Security.Cryptography;
+using System.Text;
+using Grpc.Core;
+using Grpc.Core.Interceptors;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using ZB.MOM.WW.ScadaBridge.Communication;
+using ZB.MOM.WW.ScadaBridge.Communication.Grpc;
+
+namespace ZB.MOM.WW.ScadaBridge.Host;
+
+/// <summary>
+/// Gates the site↔central gRPC control plane with a preshared key.
+/// </summary>
+/// <remarks>
+/// <para>
+/// <b>The gap this closes.</b> <c>SiteStreamService</c> shipped with no authentication at all —
+/// plaintext h2c, no interceptor. Anything that could reach a site node's gRPC port could open a
+/// live data stream or call <c>PullAuditEvents</c>/<c>PullSiteCalls</c> and read audit rows back.
+/// The only gated surface on that listener was LocalDb sync, and only for its own service. That
+/// gap exists independently of the ClusterClient→gRPC migration; it becomes indefensible once
+/// every command crosses this listener.
+/// </para>
+/// <para>
+/// <b>Modeled on <see cref="LocalDbSyncAuthInterceptor"/>,</b> deliberately: same four server
+/// handlers funnelling into one <c>Authorize</c>, same <c>authorization: Bearer</c> extraction,
+/// same <see cref="CryptographicOperations.FixedTimeEquals"/> comparison, same fail-closed
+/// posture, same <see cref="StatusCode.PermissionDenied"/> rejection. Two differences:
+/// </para>
+/// <list type="number">
+/// <item>It gates a <b>set</b> of service prefixes rather than one, so later phases can add the
+/// new command/control services without a second interceptor.</item>
+/// <item>Its expected key comes from <see cref="CommunicationOptions.GrpcPsk"/> — the site's own
+/// key, supplied in production as <c>${secret:SB-GRPC-PSK-&lt;siteId&gt;}</c> and expanded before
+/// the host is built.</item>
+/// </list>
+/// <para>
+/// <b>The two keys are separate on purpose.</b> LocalDb sync keeps its own
+/// <c>LocalDb:Replication:ApiKey</c>, which authenticates a different peer (the pair partner, not
+/// central) over a different trust relationship. Sharing one key would mean a site's central-facing
+/// key also admits writes into its database.
+/// </para>
+/// <para>
+/// <b>Fail-closed, and not optional.</b> With no <c>GrpcPsk</c> configured, every gated call is
+/// rejected — including the ones that work today. That is a deliberate break: LocalDb replication
+/// is an opt-in feature whose "off" state is "no peer", whereas streaming and audit pull are
+/// core paths, so "no key" must not silently mean "no authentication". Every environment must
+/// carry a key before upgrading to this build.
+/// </para>
+/// </remarks>
+public sealed class ControlPlaneAuthInterceptor : Interceptor
+{
+    /// <summary>
+    /// Service prefixes gated by default. Read from the generated <c>sitestream.proto</c>
+    /// package/service names — <c>package sitestream; service SiteStreamService</c>.
+    /// Later phases append their own services here.
+    /// </summary>
+    public static readonly IReadOnlyList<string> DefaultGatedPrefixes =
+        new[] { "/sitestream.SiteStreamService/" };
+
+    private readonly IReadOnlyList<string> _gatedPrefixes;
+    private readonly IOptions<CommunicationOptions> _options;
+    private readonly ILogger<ControlPlaneAuthInterceptor> _logger;
+
+    /// <summary>Creates the interceptor gating <see cref="DefaultGatedPrefixes"/>.</summary>
+    /// <param name="options">Communication options; <c>GrpcPsk</c> is the expected bearer token.</param>
+    /// <param name="logger">Logger for denial diagnostics.</param>
+    public ControlPlaneAuthInterceptor(
+        IOptions<CommunicationOptions> options,
+        ILogger<ControlPlaneAuthInterceptor> logger)
+        : this(options, logger, DefaultGatedPrefixes)
+    {
+    }
+
+    /// <summary>Creates the interceptor gating an explicit set of service prefixes.</summary>
+    /// <param name="options">Communication options; <c>GrpcPsk</c> is the expected bearer token.</param>
+    /// <param name="logger">Logger for denial diagnostics.</param>
+    /// <param name="gatedPrefixes">Method-path prefixes to gate, e.g. <c>/sitestream.SiteStreamService/</c>.</param>
+    public ControlPlaneAuthInterceptor(
+        IOptions<CommunicationOptions> options,
+        ILogger<ControlPlaneAuthInterceptor> logger,
+        IReadOnlyList<string> gatedPrefixes)
+    {
+        ArgumentNullException.ThrowIfNull(options);
+        ArgumentNullException.ThrowIfNull(logger);
+        ArgumentNullException.ThrowIfNull(gatedPrefixes);
+
+        _options = options;
+        _logger = logger;
+        _gatedPrefixes = gatedPrefixes;
+    }
+
+    /// <inheritdoc />
+    public override Task<TResponse> UnaryServerHandler<TRequest, TResponse>(
+        TRequest request,
+        ServerCallContext context,
+        UnaryServerMethod<TRequest, TResponse> continuation)
+    {
+        Authorize(context);
+        return continuation(request, context);
+    }
+
+    /// <inheritdoc />
+    public override Task DuplexStreamingServerHandler<TRequest, TResponse>(
+        IAsyncStreamReader<TRequest> requestStream,
+        IServerStreamWriter<TResponse> responseStream,
+        ServerCallContext context,
+        DuplexStreamingServerMethod<TRequest, TResponse> continuation)
+    {
+        Authorize(context);
+        return continuation(requestStream, responseStream, context);
+    }
+
+    /// <inheritdoc />
+    public override Task<TResponse> ClientStreamingServerHandler<TRequest, TResponse>(
+        IAsyncStreamReader<TRequest> requestStream,
+        ServerCallContext context,
+        ClientStreamingServerMethod<TRequest, TResponse> continuation)
+    {
+        Authorize(context);
+        return continuation(requestStream, context);
+    }
+
+    /// <inheritdoc />
+    public override Task ServerStreamingServerHandler<TRequest, TResponse>(
+        TRequest request,
+        IServerStreamWriter<TResponse> responseStream,
+        ServerCallContext context,
+        ServerStreamingServerMethod<TRequest, TResponse> continuation)
+    {
+        Authorize(context);
+        return continuation(request, responseStream, context);
+    }
+
+    /// <summary>
+    /// Throws <see cref="RpcException"/> with <see cref="StatusCode.PermissionDenied"/> if this
+    /// is a gated call that does not carry the configured bearer token. Calls to services
+    /// outside <c>gatedPrefixes</c> — notably LocalDb sync, which has its own interceptor —
+    /// return immediately.
+    /// </summary>
+    private void Authorize(ServerCallContext context)
+    {
+        if (!IsGated(context.Method))
+        {
+            return;
+        }
+
+        var expected = _options.Value.GrpcPsk;
+        if (string.IsNullOrEmpty(expected))
+        {
+            _logger.LogWarning(
+                "Rejected a control-plane call to {Method}: no ScadaBridge:Communication:GrpcPsk is "
+                + "configured, so the control plane is closed. Set the same key here (in production, "
+                + "as ${{secret:SB-GRPC-PSK-<siteId>}}) and in central's secret store.",
+                context.Method);
+            throw new RpcException(new Status(
+                StatusCode.PermissionDenied,
+                "Control plane is not accepting calls: no preshared key is configured on this node."));
+        }
+
+        var presented = ExtractBearerToken(context.RequestHeaders);
+        if (presented is null || !FixedTimeEquals(presented, expected))
+        {
+            _logger.LogWarning(
+                "Rejected a control-plane call to {Method}: {Reason}.",
+                context.Method,
+                presented is null ? "no bearer token presented" : "bearer token did not match");
+            throw new RpcException(new Status(
+                StatusCode.PermissionDenied,
+                "Control plane authentication failed."));
+        }
+    }
+
+    private bool IsGated(string method)
+    {
+        foreach (var prefix in _gatedPrefixes)
+        {
+            if (method.StartsWith(prefix, StringComparison.Ordinal))
+            {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private static string? ExtractBearerToken(Metadata headers)
+    {
+        // gRPC lowercases header keys on the wire; compare case-insensitively anyway so a
+        // hand-built Metadata in a test behaves the same as a real request.
+        foreach (var entry in headers)
+        {
+            if (!string.Equals(entry.Key, ControlPlaneCredentials.AuthorizationHeader,
+                    StringComparison.OrdinalIgnoreCase))
+            {
+                continue;
+            }
+
+            var value = entry.Value;
+            if (value is not null && value.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase))
+            {
+                return value["Bearer ".Length..];
+            }
+        }
+
+        return null;
+    }
+
+    private static bool FixedTimeEquals(string presented, string expected)
+        => CryptographicOperations.FixedTimeEquals(
+            Encoding.UTF8.GetBytes(presented), Encoding.UTF8.GetBytes(expected));
+}