fix(archreview): security authz+hub cluster (SEC-07/05/08/11) + validation hardening

SEC-07: add QueryActiveAlarmsRequest -> events:read scope arm; fix two tests that
  constructed StreamAlarmsRequest instead of QueryActiveAlarmsRequest.
SEC-05: shorten hub-token lifetime 30m -> 5m; document that the ?access_token= query
  carriage must never be request-logged.
SEC-08: gateway-side CachingApiKeyVerifier (short TTL, keyed on a hash of the presented
  secret) skips the per-call store read+last_used write; CoalescingMarkApiKeyStore bounds
  last_used writes to <=1/key/min; identity constraints are cached. Invalidation is wired
  at the gateway admin sites (revoke/rotate/delete); short TTL backstops out-of-process CLI.
SEC-11: fixed-window rate limit on POST /auth/login + a per-peer (key-id) failure limiter
  checked before VerifyAsync; new MxGateway:Security options bound + validated.

Also fixes regressions from the SEC-01/04/06 commit (c185f62) that a narrow test filter
missed (all now covered by a full-suite checkpoint):
- Rooting check is cross-platform: accepts Windows C:\/UNC forms on Unix so the shipped
  appsettings path validates on the macOS dev box, still rejecting bare filenames.
- AddGatewayConfiguration TryAdds a non-production IHostEnvironment fallback so the validator
  resolves in minimal test/tooling containers; the real host + apikey CLI register the actual
  environment first (TryAdd no-op there).
- Test assembly defaults ASPNETCORE_ENVIRONMENT=Development (ModuleInitializer) so full-host
  tests exercise wiring instead of tripping the SEC-04/06 production guards.
- GatewayOptionsTests asserts the SEC-01 CommonApplicationData-derived default (platform-correct).

archreview: SEC-07/05/08/11 (P1). Verified: NonWindows build clean; full gateway suite
747 passed / 42 failed, where all 42 are the pre-existing macOS named-pipe-harness failures
(Unix-socket path limit) and 0 are validation/regression failures.

src/ZB.MOM.WW.MxGateway.Server/GatewayApplication.cs

@@ -41,6 +41,9 @@ public static class GatewayApplication
         app.UseStaticFiles();
         app.UseAuthentication();
         app.UseAuthorization();
+        // SEC-11: the rate limiter must run after routing has selected the endpoint (so its
+        // RequireRateLimiting policy metadata is visible) and before the endpoint executes.
+        app.UseRateLimiter();
         app.UseAntiforgery();
         app.MapGatewayEndpoints();
 
@@ -68,6 +71,7 @@ public static class GatewayApplication
         builder.Services.AddGatewayConfiguration(builder.Configuration);
         builder.Services.AddSqliteAuthStore(builder.Configuration);
         builder.Services.AddGatewayGrpcAuthorization();
+        AddLoginRateLimiter(builder);
         builder.Services.AddHealthChecks()
             .AddTypeActivatedCheck<AuthStoreHealthCheck>(
                 "auth-store",
@@ -101,6 +105,26 @@ public static class GatewayApplication
         return builder;
     }
 
+    // SEC-11: register the named fixed-window rate-limiter policy applied to POST /auth/login. The
+    // limit knobs are read from MxGateway:Security at startup; the per-request partition is keyed on
+    // the remote IP (see DashboardEndpointRouteBuilderExtensions.GetLoginRateLimitPartition).
+    private static void AddLoginRateLimiter(WebApplicationBuilder builder)
+    {
+        SecurityOptions security =
+            builder.Configuration.GetSection(SecurityOptions.SectionName).Get<SecurityOptions>()
+            ?? new SecurityOptions();
+
+        builder.Services.AddRateLimiter(options =>
+        {
+            options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
+            options.AddPolicy(
+                DashboardEndpointRouteBuilderExtensions.LoginRateLimiterPolicy,
+                httpContext => DashboardEndpointRouteBuilderExtensions.GetLoginRateLimitPartition(
+                    httpContext,
+                    security));
+        });
+    }
+
     private static void ConfigureSelfSignedTls(WebApplicationBuilder builder)
     {
         if (!Security.Tls.KestrelTlsInspector.RequiresGeneratedCertificate(builder.Configuration))