feat(observability): meter bounded API-key store lookups

src/Core/ZB.MOM.WW.OtOpcUa.Commons/Observability/OtOpcUaTelemetry.cs

@@ -110,6 +110,20 @@ public static class OtOpcUaTelemetry
         Meter.CreateCounter<long>("otopcua.redundancy.primary_gate_denied", unit: "{denial}",
             description: "Operations denied by the Primary gate (site=write|ack|alarm-emit, reason=secondary|detached|role-unknown).");
 
+    /// <summary>
+    ///     API-key store lookups the 03/S18 bound intervened on (outcome=timeout|cache_hit).
+    /// </summary>
+    /// <remarks>
+    ///     One counter with an <c>outcome</c> tag rather than two: <c>timeout</c> is the alarm signal that
+    ///     the ConfigDb is not answering the OPC UA impersonation callback, and <c>cache_hit</c> is the
+    ///     ratio that says whether the TTL is doing anything. A missing <c>cache_hit</c> stream on a busy
+    ///     fused central is how you notice <c>Security:ApiKeys:StoreCacheSeconds</c> was set to 0 by
+    ///     accident. A plain read-through meters neither — the counter names interventions, not traffic.
+    /// </remarks>
+    public static readonly Counter<long> ApiKeyStoreBounded =
+        Meter.CreateCounter<long>("otopcua.opcua.apikey_store.bounded", unit: "{lookup}",
+            description: "API-key store lookups the bound intervened on (outcome=timeout|cache_hit).");
+
     // ---------------- Convenience helpers ----------------
 
     /// <summary>

src/Server/ZB.MOM.WW.OtOpcUa.Host/OpcUa/BoundedApiKeyStore.cs

@@ -1,6 +1,7 @@
 using System.Collections.Concurrent;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
+using ZB.MOM.WW.OtOpcUa.Commons.Observability;
 using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
 using ZB.MOM.WW.OtOpcUa.Core.Authorization;
 
@@ -139,6 +140,8 @@ public sealed class BoundedApiKeyStore : IApiKeyStore
     {
         if (cache.TryGetValue(key, out var entry) && _time.GetUtcNow() - entry.StampedUtc < ttl)
         {
+            OtOpcUaTelemetry.ApiKeyStoreBounded.Add(
+                1, new KeyValuePair<string, object?>("outcome", "cache_hit"));
             value = entry.Value;
             return true;
         }
@@ -202,6 +205,8 @@ public sealed class BoundedApiKeyStore : IApiKeyStore
         }
         catch (OperationCanceledException) when (!ct.IsCancellationRequested)
         {
+            OtOpcUaTelemetry.ApiKeyStoreBounded.Add(
+                1, new KeyValuePair<string, object?>("outcome", "timeout"));
             _log.LogWarning(
                 "ApiKeyStore: the key store did not answer within {TimeoutMs} ms — denying this activation. "
                 + "Every OPC UA session activation on this server is serialized behind this call; "