fix(dashboard): conditionally restore __Host- cookie prefix (SEC-03)

Restore the __Host- browser guarantees for the default secure deployment
without breaking plaintext/dev:
- DashboardServiceCollectionExtensions PostConfigure now resolves the cookie
  name as: explicit MxGateway:Dashboard:CookieName override wins; else
  __Host-MxGatewayDashboard when SecurePolicy==Always (RequireHttpsCookie
  true); else the plain MxGatewayDashboard default. Guard: never apply the
  __Host- prefix without Secure (browsers silently drop it).
- DashboardAuthenticationDefaults: add SecureCookieName const; keep the plain
  CookieName as the non-secure fallback.
- Docs corrected to the actual conditional contract (five stale claims):
  gateway.md, GatewayProcessDesign.md, ImplementationPlanGateway.md,
  GatewayDashboardDesign.md, CLAUDE.md; GatewayConfiguration.md phrasing
  tightened.
- Test: DashboardCookieOptionsTests asserts the name flips with
  RequireHttpsCookie and that an explicit override wins.

Server build clean (0 warnings); Dashboard tests 149/149.

Claude-Session: https://claude.ai/code/session_01DMXXvNuPekkkrTEyPNxEkW

src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardAuthenticationDefaults.cs

@@ -35,5 +35,23 @@ public static class DashboardAuthenticationDefaults
 
     public const string LdapGroupClaimType = "mxgateway:ldap_group";
     public const string KeyPrefixClaimType = "mxgateway:key_prefix";
+
+    /// <summary>
+    /// Dashboard auth cookie name used when the cookie is not guaranteed to be Secure
+    /// (<c>RequireHttpsCookie=false</c> → <see cref="Microsoft.AspNetCore.Authentication.Cookies.CookieSecurePolicy.SameAsRequest"/>)
+    /// or when an explicit <c>MxGateway:Dashboard:CookieName</c> override is absent but the
+    /// secure default cannot be applied. This plain name carries no browser-enforced guarantees.
+    /// </summary>
     public const string CookieName = "MxGatewayDashboard";
+
+    /// <summary>
+    /// Dashboard auth cookie name applied when the cookie is guaranteed Secure
+    /// (<c>RequireHttpsCookie=true</c> → <see cref="Microsoft.AspNetCore.Authentication.Cookies.CookieSecurePolicy.Always"/>)
+    /// and no explicit <c>MxGateway:Dashboard:CookieName</c> override is set. The <c>__Host-</c>
+    /// prefix instructs browsers to enforce Secure, no <c>Domain</c>, and <c>Path=/</c>; those
+    /// guarantees only hold for a Secure cookie, so this name must never be applied unless
+    /// <see cref="Microsoft.AspNetCore.Authentication.Cookies.CookieSecurePolicy.Always"/> is in
+    /// effect — a <c>__Host-</c> cookie without Secure is silently dropped by browsers.
+    /// </summary>
+    public const string SecureCookieName = "__Host-MxGatewayDashboard";
 }

src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardServiceCollectionExtensions.cs

@@ -123,13 +123,22 @@ public static class DashboardServiceCollectionExtensions
                     ? CookieSecurePolicy.Always
                     : CookieSecurePolicy.SameAsRequest;
 
-                // Config-driven cookie name (MxGateway:Dashboard:CookieName). Null/blank keeps
-                // the canonical default set above, so a misconfiguration cannot unname the cookie.
+                // Config-driven cookie name (MxGateway:Dashboard:CookieName). An explicit override
+                // always wins. With no override, restore the __Host- prefix when the cookie is
+                // guaranteed Secure (RequireHttpsCookie true → SecurePolicy Always): the __Host-
+                // browser guarantees (Secure required, no Domain, Path=/) hold only for a Secure
+                // cookie, and a __Host- cookie without Secure is silently dropped — so the prefix
+                // is never applied unless SecurePolicy is Always. Otherwise keep the plain
+                // canonical default set by AddCookie above, so a misconfiguration cannot unname it.
                 var cookieName = gatewayOptions.Value.Dashboard.CookieName;
                 if (!string.IsNullOrWhiteSpace(cookieName))
                 {
                     cookieOptions.Cookie.Name = cookieName;
                 }
+                else if (cookieOptions.Cookie.SecurePolicy == CookieSecurePolicy.Always)
+                {
+                    cookieOptions.Cookie.Name = DashboardAuthenticationDefaults.SecureCookieName;
+                }
             });
 
         services.AddAuthorization(authorization =>

src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/DashboardCookieOptionsTests.cs

@@ -10,7 +10,12 @@ namespace ZB.MOM.WW.MxGateway.Tests.Gateway.Dashboard;
 
 public sealed class DashboardCookieOptionsTests
 {
-    /// <summary>Verifies that the application configures secure dashboard authentication cookies.</summary>
+    /// <summary>
+    /// Verifies that the application configures secure dashboard authentication cookies.
+    /// With <c>RequireHttpsCookie</c> defaulting to <see langword="true"/> and no explicit
+    /// <c>CookieName</c> override, the cookie is named with the <c>__Host-</c> prefix so
+    /// browsers enforce the Secure/no-Domain/Path=/ guarantees the prefix promises.
+    /// </summary>
     /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task Build_ConfiguresSecureDashboardCookie()
@@ -22,7 +27,7 @@ public sealed class DashboardCookieOptionsTests
         CookieAuthenticationOptions options = optionsMonitor.Get(
             DashboardAuthenticationDefaults.AuthenticationScheme);
 
-        Assert.Equal(DashboardAuthenticationDefaults.CookieName, options.Cookie.Name);
+        Assert.Equal(DashboardAuthenticationDefaults.SecureCookieName, options.Cookie.Name);
         Assert.True(options.Cookie.HttpOnly);
         Assert.Equal(CookieSecurePolicy.Always, options.Cookie.SecurePolicy);
         Assert.Equal(SameSiteMode.Strict, options.Cookie.SameSite);
@@ -35,11 +40,14 @@ public sealed class DashboardCookieOptionsTests
     /// <summary>
     /// Verifies that setting <c>MxGateway:Dashboard:RequireHttpsCookie=false</c>
     /// relaxes the cookie to <see cref="CookieSecurePolicy.SameAsRequest"/> so
-    /// the dashboard can be reached over plain HTTP in dev.
+    /// the dashboard can be reached over plain HTTP in dev, and that the plain
+    /// <see cref="DashboardAuthenticationDefaults.CookieName"/> is used rather than the
+    /// <c>__Host-</c> name — a <c>__Host-</c> cookie without a guaranteed Secure flag is
+    /// silently dropped by browsers.
     /// </summary>
     /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
-    public async Task Build_WithRequireHttpsCookieFalse_UsesSameAsRequest()
+    public async Task Build_WithRequireHttpsCookieFalse_UsesSameAsRequestAndPlainName()
     {
         await using WebApplication app = GatewayApplication.Build(
             ["--MxGateway:Dashboard:RequireHttpsCookie=false"]);
@@ -50,12 +58,14 @@ public sealed class DashboardCookieOptionsTests
             DashboardAuthenticationDefaults.AuthenticationScheme);
 
         Assert.Equal(CookieSecurePolicy.SameAsRequest, options.Cookie.SecurePolicy);
+        Assert.Equal(DashboardAuthenticationDefaults.CookieName, options.Cookie.Name);
     }
 
     /// <summary>
-    /// Verifies that <c>MxGateway:Dashboard:CookieName</c> overrides the dashboard auth
-    /// cookie name, so a gateway instance sharing a hostname with another can be given a
-    /// distinct name (browser cookies are scoped by host+path, not port).
+    /// Verifies that an explicit <c>MxGateway:Dashboard:CookieName</c> override wins over the
+    /// secure <c>__Host-</c> default (this build leaves <c>RequireHttpsCookie</c> at its
+    /// <see langword="true"/> default), so a gateway instance sharing a hostname with another
+    /// can be given a distinct name (browser cookies are scoped by host+path, not port).
     /// </summary>
     /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]