fix(metrics-auth): DisableLogin no longer opens /metrics; log correlation pair; host-level tests

- The metrics scheme skips its dashboard-cookie fallback while
  Dashboard:DisableLogin is on, so the dev auto-login handler cannot
  satisfy RequireAuthentication=true.
- Invoke logs client_correlation_id <-> worker envelope id once at Debug.
- MetricsEndpointAuthenticationTests drives the real pipeline: anonymous
  loopback 401 (no /login redirect), Viewer cookie 200, admin key 200,
  non-admin key 403, DisableLogin 401, /health/active 200.
- Docs: DisableLogin behaviour; the /metrics limiter partition is per IP
  vs gRPC per connection, so only the per-key aggregate is shared.

src/ZB.MOM.WW.MxGateway.Server/Security/Authorization/MetricsAuthorization.cs

@@ -4,6 +4,7 @@ using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.Extensions.Options;
 using ZB.MOM.WW.Auth.Abstractions.ApiKeys;
+using ZB.MOM.WW.MxGateway.Server.Configuration;
 using ZB.MOM.WW.MxGateway.Server.Dashboard;
 using ZB.MOM.WW.MxGateway.Server.Metrics;
 
@@ -34,7 +35,9 @@ public static class MetricsAuthorizationDefaults
 /// cookie scheme on the policy directly would turn an anonymous scrape into a 302 redirect to the
 /// login page. A throttled key partition answers <c>429</c>, mirroring the gRPC
 /// <c>ResourceExhausted</c>. Failure reasons are never echoed to the caller and the presented
-/// secret is never logged.
+/// secret is never logged. The limiter's per-peer partition here is the remote IP, whereas the gRPC
+/// interceptor's is the gRPC peer string (address and port, i.e. per connection), so the two paths
+/// share only the per-key-id aggregate layer.
 /// </remarks>
 public sealed class MetricsAuthenticationHandler(
     IOptionsMonitor<AuthenticationSchemeOptions> options,
@@ -43,6 +46,7 @@ public sealed class MetricsAuthenticationHandler(
     IApiKeyVerifier apiKeyVerifier,
     ApiKeyFailureLimiter failureLimiter,
     IAuthenticationSchemeProvider schemeProvider,
+    IOptions<GatewayOptions> gatewayOptions,
     GatewayMetrics metrics)
     : AuthenticationHandler<AuthenticationSchemeOptions>(options, logger, encoder)
 {
@@ -111,6 +115,14 @@ public sealed class MetricsAuthenticationHandler(
     // signed in to the dashboard can open /metrics in the same browser.
     private async Task<AuthenticateResult> AuthenticateDashboardCookieAsync()
     {
+        // Dashboard:DisableLogin registers an always-succeeding auto-login handler under the cookie
+        // scheme name. Falling back to it would let every anonymous request satisfy /metrics, so
+        // with DisableLogin on, RequireAuthentication=true accepts API keys only.
+        if (gatewayOptions.Value.Dashboard.DisableLogin)
+        {
+            return AuthenticateResult.NoResult();
+        }
+
         if (await schemeProvider.GetSchemeAsync(DashboardAuthenticationDefaults.AuthenticationScheme).ConfigureAwait(false)
             is null)
         {