fix(delmia-notifier)+chore(docker): review follow-ups — trim the env key like the file key, log which source supplied the key (never the key), hoist the not-configured message; README warns never to commit a filled-in appsettings.json; design-doc body lines updated; seed-delmia-api.sh no longer hides CLI errors and notes key names are not unique

Claude-Session: https://claude.ai/code/session_013L3XdmVii9i5sY4FChU8pB

src/ZB.MOM.WW.ScadaBridge.DelmiaNotifier/Program.cs

@@ -5,6 +5,9 @@ internal static class Program
     /// <summary>Entry point: loads config, sends the recipe-download notification with failover across the configured base URLs, and reports the legacy YES/NO stdout contract.</summary>
     /// <param name="args">Command-line arguments parsed into the recipe download payload.</param>
     /// <returns>A task that resolves to the process exit code.</returns>
+    /// <summary>Stdout reason + log line when neither key source is set; one literal so the two cannot drift.</summary>
+    private const string ApiKeyNotConfigured = "API key not configured (SCADABRIDGE_API_KEY or ScadaBridge:ApiKey)";
+
     public static async Task<int> Main(string[] args)
     {
         var stdout = Console.Out;
@@ -39,13 +42,15 @@ internal static class Program
                 return Reporter.Report(false, "no BaseUrls configured", stdout);
             }
 
-            var apiKey = ConfigLoader.ResolveApiKey(Environment.GetEnvironmentVariable, cfg);
+            var apiKey = ConfigLoader.ResolveApiKey(Environment.GetEnvironmentVariable, cfg, out var apiKeySource);
             if (apiKey is null)
             {
-                log.Write("API key not configured (SCADABRIDGE_API_KEY or ScadaBridge:ApiKey)");
-                return Reporter.Report(false, "API key not configured (SCADABRIDGE_API_KEY or ScadaBridge:ApiKey)", stdout);
+                log.Write(ApiKeyNotConfigured);
+                return Reporter.Report(false, ApiKeyNotConfigured, stdout);
             }
 
+            log.Write("api key source: " + apiKeySource);
+
             using var http = new HttpClient { Timeout = TimeSpan.FromSeconds(cfg.ScadaBridge.TimeoutSeconds) };
             var sender = new LoggingRecipeSender(new HttpRecipeSender(http, apiKey), log);