fix(metrics-auth): DisableLogin no longer opens /metrics; log correlation pair; host-level tests

- The metrics scheme skips its dashboard-cookie fallback while
  Dashboard:DisableLogin is on, so the dev auto-login handler cannot
  satisfy RequireAuthentication=true.
- Invoke logs client_correlation_id <-> worker envelope id once at Debug.
- MetricsEndpointAuthenticationTests drives the real pipeline: anonymous
  loopback 401 (no /login redirect), Viewer cookie 200, admin key 200,
  non-admin key 403, DisableLogin 401, /health/active 200.
- Docs: DisableLogin behaviour; the /metrics limiter partition is per IP
  vs gRPC per connection, so only the per-key aggregate is shared.

src/ZB.MOM.WW.MxGateway.Tests/Gateway/Grpc/MxAccessGatewayServiceTests.cs

@@ -505,6 +505,50 @@ public sealed class MxAccessGatewayServiceTests
         Assert.Equal(string.Empty, reply.CorrelationId);
     }
 
+    /// <summary>
+    ///     Invoke logs the client correlation id alongside the worker envelope id once, at Debug, so
+    ///     a client error report can be matched to gateway and worker logs.
+    /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task Invoke_LogsClientToWorkerCorrelationPairAtDebug()
+    {
+        FakeSessionManager sessionManager = new()
+        {
+            InvokeReply = new WorkerCommandReply
+            {
+                Reply = new MxCommandReply
+                {
+                    SessionId = "session-1",
+                    CorrelationId = "envelope-7f3a",
+                    Kind = MxCommandKind.AddItem,
+                    ProtocolStatus = MxAccessGrpcMapper.Ok(),
+                    AddItem = new AddItemReply { ItemHandle = 42 },
+                },
+            },
+        };
+        RecordingLogger<MxAccessGatewayService> logger = new();
+        MxAccessGatewayService service = CreateService(sessionManager, logger: logger);
+        MxCommandRequest request = new()
+        {
+            SessionId = "session-1",
+            ClientCorrelationId = "client-trace-9",
+            Command = new MxCommand
+            {
+                Kind = MxCommandKind.AddItem,
+                AddItem = new AddItemCommand { ServerHandle = 12, ItemDefinition = "Galaxy.Tag.Value" },
+            },
+        };
+
+        await service.Invoke(request, new TestServerCallContext());
+
+        (LogLevel level, string message, _) = Assert.Single(
+            logger.Entries,
+            entry => entry.Message.Contains("envelope-7f3a", StringComparison.Ordinal));
+        Assert.Equal(LogLevel.Debug, level);
+        Assert.Contains("client-trace-9", message, StringComparison.Ordinal);
+    }
+
     /// <summary>
     ///     StreamEvents hands the call's cancellation token to every response write, so a write
     ///     blocked on a slow or vanished client is released when the call is cancelled.