fix(SEC-33,SEC-34): address code review — missed docs, key-id guard comment, test consolidation

Same-commit docs rule (were missed in the prior commit):
- docs/GalaxyRepository.md: SnapshotCachePath now documents the per-OS derived
  default and the GalaxyRepositoryOptionsValidator rooting/validity enforcement.
- A2-galaxyrepository-adoption-handoff.md: correct the now-inaccurate NSSM caveat
  (SnapshotCachePath override is optional, not required; blank seeds a rooted host
  default, no silent no-op) and repoint the option-validation item at the new
  GalaxyRepositoryOptionsValidator.

SEC-34 guard confirmed and documented: TryParseKeyId's '_' split cannot truncate a
key id because both — and the only — gateway key-creation paths
(ApiKeyAdminCommandLineParser.IsValidKeyId, DashboardApiKeyManagementService.ValidateKeyId)
restrict key ids to IsAsciiLetterOrDigit || '.' || '-', and key ids are never
library-generated. Added a citing comment; no behavior change.

Test consolidation: moved the three host-start SqlitePath overrides into
TestHostEnvironmentInitializer (per-process temp store, mirroring Secrets__SqlitePath)
so future host-start tests auto-cover.

src/ZB.MOM.WW.MxGateway.Tests/TestSupport/TestHostEnvironmentInitializer.cs

@@ -84,5 +84,19 @@ internal static class TestHostEnvironmentInitializer
                 "secrets.db");
             Environment.SetEnvironmentVariable("Secrets__SqlitePath", secretsPath);
         }
+
+        // Starting the full host eagerly opens the auth SQLite store. Since SEC-33 the shipped
+        // appsettings.json no longer carries an Authentication:SqlitePath, and the CommonApplicationData
+        // code default resolves under an unwritable /usr/share on macOS. Point every host-building test at
+        // a per-process temp store (same pattern as Secrets__SqlitePath above) so host-start tests are
+        // auto-covered without a per-test override; a test that needs its own store still overrides this.
+        if (string.IsNullOrEmpty(Environment.GetEnvironmentVariable("MxGateway__Authentication__SqlitePath")))
+        {
+            string authPath = Path.Combine(
+                Path.GetTempPath(),
+                $"mxgw-tests-{Environment.ProcessId}",
+                "gateway-auth.db");
+            Environment.SetEnvironmentVariable("MxGateway__Authentication__SqlitePath", authPath);
+        }
     }
 }