Merge branch 'fix/sec-31-32-limiter'

# Conflicts:
#	archreview/2026-07-12/remediation/00-tracking.md

src/ZB.MOM.WW.MxGateway.Tests/TestSupport/TestServerCallContext.cs

@@ -8,20 +8,32 @@ namespace ZB.MOM.WW.MxGateway.Tests.TestSupport;
 /// </summary>
 public sealed class TestServerCallContext : ServerCallContext
 {
+    private const string DefaultPeer = "ipv4:127.0.0.1:5000";
+
     private readonly Metadata _requestHeaders;
     private readonly Metadata _responseTrailers = [];
     private readonly Dictionary<object, object> _userState = [];
     private readonly CancellationToken _cancellationToken;
+    private readonly string _peer;
     private Status _status;
     private WriteOptions? _writeOptions;
 
     /// <summary>Initializes the context with the supplied request headers and cancellation token.</summary>
     /// <param name="requestHeaders">Request headers visible to the service; defaults to empty.</param>
     /// <param name="cancellationToken">Cancellation token surfaced to the service.</param>
-    public TestServerCallContext(Metadata? requestHeaders = null, CancellationToken cancellationToken = default)
+    /// <param name="peer">
+    /// Transport peer address surfaced as <see cref="ServerCallContext.Peer"/>; defaults to a
+    /// loopback address. Tests that exercise per-peer partitioning (for example the API-key failure
+    /// limiter) pass distinct values to model separate network sources.
+    /// </param>
+    public TestServerCallContext(
+        Metadata? requestHeaders = null,
+        CancellationToken cancellationToken = default,
+        string? peer = null)
     {
         _requestHeaders = requestHeaders ?? [];
         _cancellationToken = cancellationToken;
+        _peer = peer ?? DefaultPeer;
     }
 
     /// <inheritdoc />
@@ -31,7 +43,7 @@ public sealed class TestServerCallContext : ServerCallContext
     protected override string HostCore => "localhost";
 
     /// <inheritdoc />
-    protected override string PeerCore => "ipv4:127.0.0.1:5000";
+    protected override string PeerCore => _peer;
 
     /// <inheritdoc />
     protected override DateTime DeadlineCore => DateTime.UtcNow.AddMinutes(1);