docs: inbound API key store — shared SQL Server provider on central pairs (spec, runbook + central-pairs procedure, DBA DDL copy, topology, env inventory, CLAUDE.md, register row 108 closed with rig proof, row 109 Secrets backoff follow-up, Delmia spec §8)

Claude-Session: https://claude.ai/code/session_013L3XdmVii9i5sY4FChU8pB

docs/deployment/topology-guide.md

@@ -112,6 +112,14 @@ Both central nodes share state through:
 - **SQL Server**: All configuration, deployment records, templates, and audit logs.
 - **JWT signing key**: Same `JwtSigningKey` in both nodes' configuration.
 - **Data Protection keys**: Shared key ring (stored in SQL Server or shared file path).
+- **Inbound API keys**: shared **only** when `ScadaBridge:InboundApi:ApiKeyStore:Provider = SqlServer`
+  (design 2026-09-02, register row 108) — both nodes then read/write the same `zbauth` schema in the
+  configuration database, so create/revoke/rotate/scope changes are cluster-wide immediately. The
+  library default, `Provider = Sqlite`, stores keys in a **per-node** file instead; running `Sqlite`
+  on a central pair is a documented misconfiguration — `StartupValidator` logs a boot-time Warning
+  because a failover then 401s every inbound client until keys are re-issued on the survivor. Both
+  docker rigs run `SqlServer`; see `docs/operations/inbound-api-key-reissue.md` → *Central pairs* to
+  migrate an existing pair.
 
 ### Load Balancer