Resolve Server-044..050: KillWorker accounting + admin service hardening

Server-044  KillWorkerAsync catch path now calls _metrics.SessionRemoved
            so the open-session gauge does not leak when KillWorker throws.
Server-045  KillWorkerAsync routes through a new
            GatewaySession.KillWorkerWithCloseGateAsync that takes the
            per-session close lock, so concurrent kills count SessionsClosed
            exactly once.
Server-046  CloseSessionCoreAsync's SessionCloseStartedException branch and
            ShutdownAsync's kill fallback both increment SessionsClosed (not
            just the gauge), so the counter and gauge stay consistent.
Server-047  ApiKeysPage.ConfirmPendingAsync holds PendingAction across the
            awaited action and clears it in finally, matching the sessions
            pages.
Server-048  Closed: the 044/045 regression tests cover the previously-
            untested kill paths.
Server-049  IDashboardSessionAdminService + DashboardSessionAdminService
            now carry XML docs that pin the Admin gate, missing-session
            return-Fail semantics, and the dashboard-admin-kill reason.
Server-050  CloseSessionAsync and KillWorkerAsync catch unexpected
            exceptions after the SessionManagerException catches and return
            a friendly Fail; OperationCanceledException tied to the caller
            token still propagates.

All resolved at 2026-05-24; 503/503 gateway tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/ZB.MOM.WW.MxGateway.Server/Sessions/GatewaySession.cs

@@ -840,6 +840,45 @@ public sealed class GatewaySession
         TransitionTo(SessionState.Closed);
     }
 
+    /// <summary>
+    /// Terminates the worker process immediately while holding the per-session
+    /// close lock so concurrent close/kill callers serialize. Returns the
+    /// session state observed at the start of the call so the caller can
+    /// dedup metric accounting (e.g. only record <c>SessionClosed</c> when
+    /// the session was not already closed).
+    /// </summary>
+    /// <remarks>
+    ///     Mirrors <see cref="CloseAsync"/>'s use of <c>_closeLock</c> so that
+    ///     a Close in flight from one caller and a Kill from another do not
+    ///     race on the "was the session already closed" observation that
+    ///     drives metric increments (Server-045).
+    /// </remarks>
+    /// <param name="reason">Reason for killing the worker.</param>
+    /// <param name="cancellationToken">Cancellation token.</param>
+    /// <returns><c>true</c> if the session was already <see cref="SessionState.Closed"/> when the lock was acquired; otherwise <c>false</c>.</returns>
+    public async ValueTask<bool> KillWorkerWithCloseGateAsync(
+        string reason,
+        CancellationToken cancellationToken)
+    {
+        await _closeLock.WaitAsync(cancellationToken).ConfigureAwait(false);
+        try
+        {
+            bool wasClosed;
+            lock (_syncRoot)
+            {
+                wasClosed = _state == SessionState.Closed;
+            }
+
+            _workerClient?.Kill(reason);
+            TransitionTo(SessionState.Closed);
+            return wasClosed;
+        }
+        finally
+        {
+            _closeLock.Release();
+        }
+    }
+
     /// <summary>
     /// Disposes the session and frees associated resources.
     /// </summary>