fix(archreview): security authz+hub cluster (SEC-07/05/08/11) + validation hardening

SEC-07: add QueryActiveAlarmsRequest -> events:read scope arm; fix two tests that
  constructed StreamAlarmsRequest instead of QueryActiveAlarmsRequest.
SEC-05: shorten hub-token lifetime 30m -> 5m; document that the ?access_token= query
  carriage must never be request-logged.
SEC-08: gateway-side CachingApiKeyVerifier (short TTL, keyed on a hash of the presented
  secret) skips the per-call store read+last_used write; CoalescingMarkApiKeyStore bounds
  last_used writes to <=1/key/min; identity constraints are cached. Invalidation is wired
  at the gateway admin sites (revoke/rotate/delete); short TTL backstops out-of-process CLI.
SEC-11: fixed-window rate limit on POST /auth/login + a per-peer (key-id) failure limiter
  checked before VerifyAsync; new MxGateway:Security options bound + validated.

Also fixes regressions from the SEC-01/04/06 commit (c185f62) that a narrow test filter
missed (all now covered by a full-suite checkpoint):
- Rooting check is cross-platform: accepts Windows C:\/UNC forms on Unix so the shipped
  appsettings path validates on the macOS dev box, still rejecting bare filenames.
- AddGatewayConfiguration TryAdds a non-production IHostEnvironment fallback so the validator
  resolves in minimal test/tooling containers; the real host + apikey CLI register the actual
  environment first (TryAdd no-op there).
- Test assembly defaults ASPNETCORE_ENVIRONMENT=Development (ModuleInitializer) so full-host
  tests exercise wiring instead of tripping the SEC-04/06 production guards.
- GatewayOptionsTests asserts the SEC-01 CommonApplicationData-derived default (platform-correct).

archreview: SEC-07/05/08/11 (P1). Verified: NonWindows build clean; full gateway suite
747 passed / 42 failed, where all 42 are the pre-existing macOS named-pipe-harness failures
(Unix-socket path limit) and 0 are validation/regression failures.

src/ZB.MOM.WW.MxGateway.Server/Dashboard/HubTokenService.cs

@@ -26,7 +26,15 @@ namespace ZB.MOM.WW.MxGateway.Server.Dashboard;
 public sealed class HubTokenService
 {
     private const string ProtectorPurpose = "ZB.MOM.WW.MxGateway.Dashboard.HubToken.v1";
-    private static readonly TimeSpan TokenLifetime = TimeSpan.FromMinutes(30);
+
+    // Hub bearer tokens are single-purpose, data-protection-encrypted, and NOT server-side
+    // revocable. A short lifetime bounds the exposure window of a token captured from a proxy
+    // or log after logout (the cookie is cleared on logout, but outstanding tokens are not), and
+    // bounds how long a stale role set survives a role change. Five minutes is transparent to
+    // clients because DashboardHubConnectionFactory mints a fresh token on every (re)connect;
+    // see docs/GatewayDashboardDesign.md. Heavier jti-denylist revocation is deliberately
+    // deferred until per-session hub ACLs land (SEC-25), when tokens gain session binding.
+    internal static readonly TimeSpan TokenLifetime = TimeSpan.FromMinutes(5);
 
     private readonly ITimeLimitedDataProtector _protector;
 
@@ -41,14 +49,24 @@ public sealed class HubTokenService
     /// <summary>Issues a bearer token carrying the user's identity and roles.</summary>
     /// <param name="user">The claims principal representing the user.</param>
     /// <returns>The data-protected bearer token string.</returns>
-    public string Issue(ClaimsPrincipal user)
+    public string Issue(ClaimsPrincipal user) => Issue(user, TokenLifetime);
+
+    /// <summary>
+    /// Issues a bearer token that expires after the supplied lifetime. Test seam so a caller can
+    /// mint an already-expired token deterministically without wall-clock delay; production callers
+    /// use <see cref="Issue(ClaimsPrincipal)"/> and get <see cref="TokenLifetime"/>.
+    /// </summary>
+    /// <param name="user">The claims principal representing the user.</param>
+    /// <param name="lifetime">The lifetime applied to the token; a non-positive value yields an already-expired token.</param>
+    /// <returns>The data-protected bearer token string.</returns>
+    internal string Issue(ClaimsPrincipal user, TimeSpan lifetime)
     {
         ArgumentNullException.ThrowIfNull(user);
         HubTokenPayload payload = new(
             user.Identity?.Name,
             user.FindFirstValue(ClaimTypes.NameIdentifier),
             [.. user.FindAll(ClaimTypes.Role).Select(c => c.Value)]);
-        return _protector.Protect(JsonSerializer.Serialize(payload), TokenLifetime);
+        return _protector.Protect(JsonSerializer.Serialize(payload), lifetime);
     }
 
     /// <summary>Validates a token and returns the equivalent claims principal; null when invalid or expired.</summary>