fix(SEC-33,SEC-34): host-meaningful path rooting; verification-cache invalidate race

SEC-33: make rooting host-meaningful and stop shipping foreign-platform literals.
- Delete IsRootedForAnyPlatform; AddIfNotRooted now uses Path.IsPathRooted (current OS).
- Promote AddIfNotRooted/AddIfInvalidPath to shared GatewayConfigPathRules so the new
  Galaxy validator reuses them and the two validators cannot drift.
- Remove Authentication:SqlitePath and Galaxy:SnapshotCachePath Windows literals from
  appsettings.json; the CommonApplicationData-derived code defaults take over. The
  Galaxy default is seeded as a configuration value before AddZbGalaxyRepository
  (SnapshotCachePath is init-only, so a PostConfigure mutation cannot compile).
- New GalaxyRepositoryOptionsValidator (ValidateOnStart) enforces a valid, host-rooted
  SnapshotCachePath when PersistSnapshot is true.
- Root-cause the stray junk-named auth DB: host start eagerly builds
  AuthSqliteConnectionFactory; under the non-rooted Windows literal on macOS SQLite
  wrote it relative to the test bin CWD. The three real-host-start tests now pin
  SqlitePath to a temp path.

SEC-34: verification cache Invalidate-vs-in-flight-repopulation race closed with a
per-key generation counter (bump-before-evict, snapshot-then-recheck). The expiry
cap (window 2) takes the documented fallback: the library verification identity
carries no ExpiresUtc, so the cache cannot cap at the key's expiry (donor-library ask).

GWC-24 rider: cap MxGateway:Events:QueueCapacity at int.MaxValue/2 so the derived
checked(2 * EventChannelCapacity) in WorkerClient cannot overflow at session creation.

SEC-35 (doc-only): note IsProduction() env-name semantics in GatewayConfiguration.md.

Docs updated same commit (GatewayConfiguration.md, Authentication.md) and tracking
registers/change-log flipped (00-tracking.md, 40-security-dashboard.md).

src/ZB.MOM.WW.MxGateway.Server/GatewayApplication.cs

@@ -134,8 +134,29 @@ public static class GatewayApplication
         // library's TryAddSingleton default (NullGalaxyBrowseScopeProvider) does not win.
         builder.Services.AddSingleton<ZB.MOM.WW.GalaxyRepository.Grpc.IGalaxyBrowseScopeProvider,
             Security.Authorization.GatewayBrowseScopeProvider>();
+
+        // The Galaxy package binds GalaxyRepositoryOptions but ships no validator or default for the
+        // snapshot path (A2 handoff): the gateway owns both because it is the process that writes the
+        // snapshot. GalaxyRepositoryOptions.SnapshotCachePath is init-only, so the default cannot be
+        // applied via PostConfigure — supply it as a configuration value (before the bind) when the
+        // shipped config leaves it blank. It resolves to the per-OS CommonApplicationData location,
+        // byte-identical to the removed appsettings literal on Windows (SEC-33).
+        if (string.IsNullOrWhiteSpace(builder.Configuration["MxGateway:Galaxy:SnapshotCachePath"]))
+        {
+            builder.Configuration["MxGateway:Galaxy:SnapshotCachePath"] = Path.Combine(
+                Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData),
+                "MxGateway",
+                "galaxy-snapshot.json");
+        }
+
         builder.Services.AddZbGalaxyRepository(builder.Configuration, "MxGateway:Galaxy");
 
+        // Validate that persistence has a valid, host-rooted snapshot path (SEC-33).
+        builder.Services.AddSingleton<
+            Microsoft.Extensions.Options.IValidateOptions<ZB.MOM.WW.GalaxyRepository.GalaxyRepositoryOptions>,
+            Configuration.GalaxyRepositoryOptionsValidator>();
+        builder.Services.AddOptions<ZB.MOM.WW.GalaxyRepository.GalaxyRepositoryOptions>().ValidateOnStart();
+
         return builder;
     }