fix(archreview): security authz+hub cluster (SEC-07/05/08/11) + validation hardening

SEC-07: add QueryActiveAlarmsRequest -> events:read scope arm; fix two tests that
  constructed StreamAlarmsRequest instead of QueryActiveAlarmsRequest.
SEC-05: shorten hub-token lifetime 30m -> 5m; document that the ?access_token= query
  carriage must never be request-logged.
SEC-08: gateway-side CachingApiKeyVerifier (short TTL, keyed on a hash of the presented
  secret) skips the per-call store read+last_used write; CoalescingMarkApiKeyStore bounds
  last_used writes to <=1/key/min; identity constraints are cached. Invalidation is wired
  at the gateway admin sites (revoke/rotate/delete); short TTL backstops out-of-process CLI.
SEC-11: fixed-window rate limit on POST /auth/login + a per-peer (key-id) failure limiter
  checked before VerifyAsync; new MxGateway:Security options bound + validated.

Also fixes regressions from the SEC-01/04/06 commit (c185f62) that a narrow test filter
missed (all now covered by a full-suite checkpoint):
- Rooting check is cross-platform: accepts Windows C:\/UNC forms on Unix so the shipped
  appsettings path validates on the macOS dev box, still rejecting bare filenames.
- AddGatewayConfiguration TryAdds a non-production IHostEnvironment fallback so the validator
  resolves in minimal test/tooling containers; the real host + apikey CLI register the actual
  environment first (TryAdd no-op there).
- Test assembly defaults ASPNETCORE_ENVIRONMENT=Development (ModuleInitializer) so full-host
  tests exercise wiring instead of tripping the SEC-04/06 production guards.
- GatewayOptionsTests asserts the SEC-01 CommonApplicationData-derived default (platform-correct).

archreview: SEC-07/05/08/11 (P1). Verified: NonWindows build clean; full gateway suite
747 passed / 42 failed, where all 42 are the pre-existing macOS named-pipe-harness failures
(Unix-socket path limit) and 0 are validation/regression failures.

src/ZB.MOM.WW.MxGateway.Tests/Configuration/GatewayOptionsTests.cs

@@ -14,7 +14,15 @@ public sealed class GatewayOptionsTests
         GatewayOptions options = BindOptions(new Dictionary<string, string?>());
 
         Assert.Equal(AuthenticationMode.ApiKey, options.Authentication.Mode);
-        Assert.Equal(@"C:\ProgramData\MxGateway\gateway-auth.db", options.Authentication.SqlitePath);
+        // SEC-01: the default is derived from CommonApplicationData (C:\ProgramData on Windows,
+        // /usr/share on Unix) rather than a Windows literal, so assert against the same derivation
+        // to stay platform-correct.
+        Assert.Equal(
+            Path.Combine(
+                Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData),
+                "MxGateway",
+                "gateway-auth.db"),
+            options.Authentication.SqlitePath);
         Assert.Equal("MxGateway:ApiKeyPepper", options.Authentication.PepperSecretName);
         Assert.True(options.Authentication.RunMigrationsOnStartup);
 

src/ZB.MOM.WW.MxGateway.Tests/Configuration/GatewayOptionsValidatorTests.cs

@@ -683,4 +683,92 @@ public sealed class GatewayOptionsValidatorTests
         ValidateOptionsResult result = new GatewayOptionsValidator(isProduction: true).Validate(null, options);
         Assert.True(result.Succeeded);
     }
+
+    // ---- SEC-11: MxGateway:Security validation ----
+
+    private static GatewayOptions WithSecurity(SecurityOptions security) => new() { Security = security };
+
+    /// <summary>Verifies the default security options pass validation.</summary>
+    [Fact]
+    public void Validate_Succeeds_WithDefaultSecurityOptions()
+    {
+        ValidateOptionsResult result = new GatewayOptionsValidator().Validate(null, WithSecurity(new SecurityOptions()));
+        Assert.True(result.Succeeded);
+    }
+
+    /// <summary>Verifies a zero verification-cache TTL is allowed (disables caching).</summary>
+    [Fact]
+    public void Validate_Succeeds_WhenVerificationCacheSecondsZero()
+    {
+        ValidateOptionsResult result = new GatewayOptionsValidator().Validate(
+            null,
+            WithSecurity(new SecurityOptions { ApiKeyVerificationCacheSeconds = 0 }));
+        Assert.True(result.Succeeded);
+    }
+
+    /// <summary>Verifies a negative verification-cache TTL fails validation.</summary>
+    [Fact]
+    public void Validate_Fails_WhenVerificationCacheSecondsNegative()
+    {
+        ValidateOptionsResult result = new GatewayOptionsValidator().Validate(
+            null,
+            WithSecurity(new SecurityOptions { ApiKeyVerificationCacheSeconds = -1 }));
+        Assert.True(result.Failed);
+        Assert.Contains(result.Failures!, f => f.Contains("ApiKeyVerificationCacheSeconds"));
+    }
+
+    /// <summary>Verifies a negative last-used coalesce window fails validation.</summary>
+    [Fact]
+    public void Validate_Fails_WhenLastUsedCoalesceSecondsNegative()
+    {
+        ValidateOptionsResult result = new GatewayOptionsValidator().Validate(
+            null,
+            WithSecurity(new SecurityOptions { ApiKeyLastUsedCoalesceSeconds = -5 }));
+        Assert.True(result.Failed);
+        Assert.Contains(result.Failures!, f => f.Contains("ApiKeyLastUsedCoalesceSeconds"));
+    }
+
+    /// <summary>Verifies a zero login rate-limit permit fails validation.</summary>
+    [Fact]
+    public void Validate_Fails_WhenLoginRateLimitPermitLimitZero()
+    {
+        ValidateOptionsResult result = new GatewayOptionsValidator().Validate(
+            null,
+            WithSecurity(new SecurityOptions { LoginRateLimitPermitLimit = 0 }));
+        Assert.True(result.Failed);
+        Assert.Contains(result.Failures!, f => f.Contains("LoginRateLimitPermitLimit"));
+    }
+
+    /// <summary>Verifies a zero login rate-limit window fails validation.</summary>
+    [Fact]
+    public void Validate_Fails_WhenLoginRateLimitWindowSecondsZero()
+    {
+        ValidateOptionsResult result = new GatewayOptionsValidator().Validate(
+            null,
+            WithSecurity(new SecurityOptions { LoginRateLimitWindowSeconds = 0 }));
+        Assert.True(result.Failed);
+        Assert.Contains(result.Failures!, f => f.Contains("LoginRateLimitWindowSeconds"));
+    }
+
+    /// <summary>Verifies a zero API-key failure limit fails validation.</summary>
+    [Fact]
+    public void Validate_Fails_WhenApiKeyFailureLimitZero()
+    {
+        ValidateOptionsResult result = new GatewayOptionsValidator().Validate(
+            null,
+            WithSecurity(new SecurityOptions { ApiKeyFailureLimit = 0 }));
+        Assert.True(result.Failed);
+        Assert.Contains(result.Failures!, f => f.Contains("ApiKeyFailureLimit"));
+    }
+
+    /// <summary>Verifies a zero tracked-peer cap fails validation.</summary>
+    [Fact]
+    public void Validate_Fails_WhenApiKeyFailureTrackedPeersZero()
+    {
+        ValidateOptionsResult result = new GatewayOptionsValidator().Validate(
+            null,
+            WithSecurity(new SecurityOptions { ApiKeyFailureTrackedPeers = 0 }));
+        Assert.True(result.Failed);
+        Assert.Contains(result.Failures!, f => f.Contains("ApiKeyFailureTrackedPeers"));
+    }
 }