fix(security): wrap the ConfigDb key store on admin nodes + registration guard

src/Server/ZB.MOM.WW.OtOpcUa.Host/OpcUa/BoundedApiKeyStore.cs

@@ -81,6 +81,18 @@ public sealed class BoundedApiKeyStore : IApiKeyStore
         _time = time;
     }
 
+    /// <summary>The store being bounded.</summary>
+    /// <remarks>
+    ///     Exposed so the composition root's wiring can be asserted. A decorator registered in one branch
+    ///     of a role conditional is the "built but never wired" shape, and a guard that cannot see what is
+    ///     inside the wrapper cannot tell a correctly-wired node from one wrapping the wrong store.
+    /// </remarks>
+    public IApiKeyStore Inner => _inner;
+
+    /// <summary>The clock this bound's deadline and TTL are measured on.</summary>
+    /// <remarks>Same reason as <see cref="Inner"/>: the shared-clock invariant is only pinnable by reference.</remarks>
+    public TimeProvider Clock => _time;
+
     /// <inheritdoc />
     /// <remarks>
     ///     Keyed by <paramref name="apiKeyId"/> alone. <paramref name="utcNow"/> is deliberately not part