fix(central): audit per-node central caches; management API drops ApiMethodCache entries (ScadaBridge#85)

Audit (docs/plans/2026-11-09-central-cache-staleness-audit.md) of every central in-process
cache holding configuration or secret state, with its staleness bound on the peer central
node. Every config cache with peer staleness is TTL-bounded (5-60 s) and Traefik routes to the
active node only, so no peer case was clearly a bug and no cross-node broadcast is added; the
doc names the existing DistributedPubSub mediator (health replication topic) as the mechanism
if one is wanted. Owner decisions listed: RoleMappingCache 30 s revocation lag on the peer,
SitePskProvider caching a PSK forever across an in-place rotation (both nodes), and the #83
ExternalDefinitionLookupCache 10 s bound.

Fixed: ManagementActor API-method create/update/delete invalidated only the compiled handler,
not ApiMethodCache, so the node that made the change kept serving the pre-change row for up to
the 5 s TTL (a deleted method stayed callable; a cached not-found hid a new one). The handlers
now drop the entry post-commit, like the role-mapping cache.

Tests: ApiMethodCacheInvalidationTests (create/update/delete fail without the fix; a
negative control checks other methods stay cached).

(ScadaBridge#85)

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

tests/ZB.MOM.WW.ScadaBridge.ManagementService.Tests/ApiMethodCacheInvalidationTests.cs

@@ -0,0 +1,114 @@
+using Akka.Actor;
+using Akka.TestKit.Xunit2;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging.Abstractions;
+using NSubstitute;
+using ZB.MOM.WW.ScadaBridge.Commons.Entities.InboundApi;
+using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Repositories;
+using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Services;
+using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management;
+using ZB.MOM.WW.ScadaBridge.InboundAPI;
+
+namespace ZB.MOM.WW.ScadaBridge.ManagementService.Tests;
+
+/// <summary>
+/// Gitea #85: an API-method create / update / delete through the management API must drop this
+/// node's <see cref="ApiMethodCache"/> entry once the change commits. Before, only the compiled
+/// handler was invalidated, so the node kept resolving the pre-change row for up to the cache
+/// TTL — a deleted method stayed callable and a cached not-found hid a newly created one.
+/// </summary>
+public class ApiMethodCacheInvalidationTests : TestKit
+{
+    private readonly ServiceCollection _services = new ServiceCollection().AddTestConfigurationTransaction();
+    private readonly IInboundApiRepository _apiRepo = Substitute.For<IInboundApiRepository>();
+
+    // A TTL far longer than the test, so only an explicit invalidation can clear an entry.
+    private readonly ApiMethodCache _cache = new(TimeSpan.FromHours(1));
+
+    /// <summary>Initializes the harness with a long-TTL method cache.</summary>
+    public ApiMethodCacheInvalidationTests()
+    {
+        _services.AddScoped(_ => _apiRepo);
+        _services.AddScoped(_ => Substitute.For<IAuditService>());
+        _services.AddSingleton(_cache);
+        _apiRepo.SaveChangesAsync(Arg.Any<CancellationToken>()).Returns(1);
+    }
+
+    private IActorRef CreateActor() =>
+        Sys.ActorOf(Props.Create(() => new ManagementActor(
+            _services.BuildServiceProvider(), NullLogger<ManagementActor>.Instance)));
+
+    private static ManagementEnvelope Envelope(object command) =>
+        new(new AuthenticatedUser("designer", "Designer", new[] { "Designer" }, Array.Empty<string>()),
+            command, Guid.NewGuid().ToString("N"));
+
+    private Task Seed(string name, ApiMethod? row) =>
+        _cache.GetOrFetchAsync(name, _ => Task.FromResult(row), CancellationToken.None);
+
+    /// <summary>Returns true when the cache re-fetches <paramref name="name"/> (the entry was dropped).</summary>
+    private async Task<bool> Refetches(string name)
+    {
+        var fetched = false;
+        await _cache.GetOrFetchAsync(name, _ => { fetched = true; return Task.FromResult<ApiMethod?>(null); }, CancellationToken.None);
+        return fetched;
+    }
+
+    /// <summary>A cached not-found must not hide a method created through the management API.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task Create_DropsCachedNotFound()
+    {
+        await Seed("Fresh", null);
+        Assert.False(await Refetches("Fresh")); // positive control: the negative entry is served
+
+        CreateActor().Tell(Envelope(new CreateApiMethodCommand("Fresh", "return 1;", 30, null, null)));
+        ExpectMsg<ManagementSuccess>(TimeSpan.FromSeconds(30));
+
+        Assert.True(await Refetches("Fresh"));
+    }
+
+    /// <summary>An update drops the cached pre-change row.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task Update_DropsCachedRow()
+    {
+        var existing = new ApiMethod("Edited", "return 1;") { Id = 7, TimeoutSeconds = 10 };
+        _apiRepo.GetApiMethodByIdAsync(7, Arg.Any<CancellationToken>()).Returns(existing);
+        await Seed("Edited", existing);
+
+        CreateActor().Tell(Envelope(new UpdateApiMethodCommand(7, "return 2;", 10, null, null)));
+        ExpectMsg<ManagementSuccess>(TimeSpan.FromSeconds(30));
+
+        Assert.True(await Refetches("Edited"));
+    }
+
+    /// <summary>A delete drops the cached row so the deleted method is no longer resolved.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task Delete_DropsCachedRow()
+    {
+        var existing = new ApiMethod("Gone", "return 1;") { Id = 9, TimeoutSeconds = 10 };
+        _apiRepo.GetApiMethodByIdAsync(9, Arg.Any<CancellationToken>()).Returns(existing);
+        await Seed("Gone", existing);
+
+        CreateActor().Tell(Envelope(new DeleteApiMethodCommand(9)));
+        ExpectMsg<ManagementSuccess>(TimeSpan.FromSeconds(30));
+
+        Assert.True(await Refetches("Gone"));
+    }
+
+    /// <summary>A change to one method leaves other methods' entries cached.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task Delete_LeavesOtherMethodsCached()
+    {
+        var existing = new ApiMethod("Gone2", "return 1;") { Id = 10, TimeoutSeconds = 10 };
+        _apiRepo.GetApiMethodByIdAsync(10, Arg.Any<CancellationToken>()).Returns(existing);
+        await Seed("Other", new ApiMethod("Other", "return 3;"));
+
+        CreateActor().Tell(Envelope(new DeleteApiMethodCommand(10)));
+        ExpectMsg<ManagementSuccess>(TimeSpan.FromSeconds(30));
+
+        Assert.False(await Refetches("Other"));
+    }
+}