fix(archreview): security authz+hub cluster (SEC-07/05/08/11) + validation hardening

SEC-07: add QueryActiveAlarmsRequest -> events:read scope arm; fix two tests that
  constructed StreamAlarmsRequest instead of QueryActiveAlarmsRequest.
SEC-05: shorten hub-token lifetime 30m -> 5m; document that the ?access_token= query
  carriage must never be request-logged.
SEC-08: gateway-side CachingApiKeyVerifier (short TTL, keyed on a hash of the presented
  secret) skips the per-call store read+last_used write; CoalescingMarkApiKeyStore bounds
  last_used writes to <=1/key/min; identity constraints are cached. Invalidation is wired
  at the gateway admin sites (revoke/rotate/delete); short TTL backstops out-of-process CLI.
SEC-11: fixed-window rate limit on POST /auth/login + a per-peer (key-id) failure limiter
  checked before VerifyAsync; new MxGateway:Security options bound + validated.

Also fixes regressions from the SEC-01/04/06 commit (c185f62) that a narrow test filter
missed (all now covered by a full-suite checkpoint):
- Rooting check is cross-platform: accepts Windows C:\/UNC forms on Unix so the shipped
  appsettings path validates on the macOS dev box, still rejecting bare filenames.
- AddGatewayConfiguration TryAdds a non-production IHostEnvironment fallback so the validator
  resolves in minimal test/tooling containers; the real host + apikey CLI register the actual
  environment first (TryAdd no-op there).
- Test assembly defaults ASPNETCORE_ENVIRONMENT=Development (ModuleInitializer) so full-host
  tests exercise wiring instead of tripping the SEC-04/06 production guards.
- GatewayOptionsTests asserts the SEC-01 CommonApplicationData-derived default (platform-correct).

archreview: SEC-07/05/08/11 (P1). Verified: NonWindows build clean; full gateway suite
747 passed / 42 failed, where all 42 are the pre-existing macOS named-pipe-harness failures
(Unix-socket path limit) and 0 are validation/regression failures.

src/ZB.MOM.WW.MxGateway.Server/Security/Authentication/GatewayApiKeyIdentityMapper.cs

@@ -1,3 +1,5 @@
+using System.Collections.Concurrent;
+
 using LibApiKeyIdentity = ZB.MOM.WW.Auth.Abstractions.ApiKeys.ApiKeyIdentity;
 
 namespace ZB.MOM.WW.MxGateway.Server.Security.Authentication;
@@ -17,6 +19,36 @@ namespace ZB.MOM.WW.MxGateway.Server.Security.Authentication;
 /// </remarks>
 public static class GatewayApiKeyIdentityMapper
 {
+    // SEC-08: memoize the constraints deserialization keyed by the raw JSON blob so the per-call
+    // JSON parse on the auth hot path collapses to a dictionary lookup. Distinct blobs are bounded
+    // by the number of API keys (small); ApiKeyConstraints is an immutable record, so a parsed
+    // instance is safe to share across callers. The cap is a defensive backstop against a pathological
+    // spread of distinct blobs — past it, we simply parse without caching rather than grow unbounded.
+    private const int MaxCachedConstraintBlobs = 1024;
+    private static readonly ConcurrentDictionary<string, ApiKeyConstraints> ConstraintCache =
+        new(StringComparer.Ordinal);
+
+    private static ApiKeyConstraints DeserializeConstraints(string? constraintsJson)
+    {
+        if (string.IsNullOrWhiteSpace(constraintsJson))
+        {
+            return ApiKeyConstraints.Empty;
+        }
+
+        if (ConstraintCache.TryGetValue(constraintsJson, out ApiKeyConstraints? cached))
+        {
+            return cached;
+        }
+
+        ApiKeyConstraints parsed = ApiKeyConstraintSerializer.Deserialize(constraintsJson);
+        if (ConstraintCache.Count < MaxCachedConstraintBlobs)
+        {
+            ConstraintCache.TryAdd(constraintsJson, parsed);
+        }
+
+        return parsed;
+    }
+
     /// <summary>
     /// Converts a shared API-key identity into the gateway identity, deserializing the opaque
     /// constraints JSON into <see cref="ApiKeyConstraints"/>.
@@ -38,6 +70,6 @@ public static class GatewayApiKeyIdentityMapper
             KeyPrefix: "mxgw",
             DisplayName: identity.DisplayName,
             Scopes: identity.Scopes,
-            Constraints: ApiKeyConstraintSerializer.Deserialize(constraintsJson));
+            Constraints: DeserializeConstraints(constraintsJson));
     }
 }