fix(m9/T32b): resolve $ref in InboundAPI runtime validators (no deploy-passes/runtime-400); diamond test; ref-annotation message

src/ZB.MOM.WW.ScadaBridge.InboundAPI/EndpointExtensions.cs

@@ -193,7 +193,20 @@ public static class EndpointExtensions
                 statusCode: 400);
         }
 
-        var paramResult = ParameterValidator.Validate(body, method.ParameterDefinitions);
+        // M9-T32b: thread the JSON-Schema $ref resolution seam into parameter
+        // validation so a method whose ParameterDefinitions use a {"$ref":"lib:Name"}
+        // resolves the reference at RUNTIME (not just at deploy time). The shared-schema
+        // library is pre-loaded ONCE per request into an in-memory map (the seam the
+        // validator consumes is synchronous), and ONLY when the definition actually uses
+        // a $ref — a $ref-free method skips the repository round-trip entirely. A dangling
+        // ref surfaces as a clear, descriptive 400 naming the missing reference rather
+        // than an opaque parse-error 400 (the deploy-passes/runtime-breaks defect).
+        var sharedSchemaRepo =
+            httpContext.RequestServices.GetService<ISharedSchemaRepository>();
+        var resolveRef = await SchemaRefResolver.BuildAsync(
+            sharedSchemaRepo, [method.ParameterDefinitions], httpContext.RequestAborted);
+
+        var paramResult = ParameterValidator.Validate(body, method.ParameterDefinitions, resolveRef);
         if (!paramResult.IsValid)
         {
             return Results.Json(