fix(archreview): security config guards (SEC-01/04/06)

- SEC-01: derive AuthenticationOptions.SqlitePath / TlsOptions.SelfSignedCertPath
  defaults from SpecialFolder.CommonApplicationData (was Windows-literal strings
  that became CWD-relative files off-Windows); validator rejects non-rooted
  overrides; delete the stray C:\ProgramData\...gateway-auth.db files that
  materialized under src/; add a tree-hygiene test failing on any *.db under src/.
- SEC-04: GatewayOptionsValidator fails startup when IsProduction() && DisableLogin.
- SEC-06: validator rejects LDAP Transport=None in Production; document the
  MxGateway__Ldap__ServiceAccountPassword env override + dev-credential rotation.

Galaxy SnapshotCachePath rooting could not be validator-enforced (bound by the
external GalaxyRepository package, not GatewayOptions) — documented instead.

archreview: SEC-01/04/06 (P1). Verified on the Auth-0.1.4 baseline: Server build
clean, GatewayOptionsValidator + GatewayTreeHygiene tests 53/53.

src/ZB.MOM.WW.MxGateway.Server/Configuration/AuthenticationOptions.cs

@@ -5,8 +5,18 @@ public sealed class AuthenticationOptions
     /// <summary>Gets the authentication mode.</summary>
     public AuthenticationMode Mode { get; init; } = AuthenticationMode.ApiKey;
 
-    /// <summary>Gets the SQLite database path for authentication credentials.</summary>
-    public string SqlitePath { get; init; } = @"C:\ProgramData\MxGateway\gateway-auth.db";
+    /// <summary>
+    /// Gets the SQLite database path for authentication credentials. The default is
+    /// derived from <see cref="Environment.SpecialFolder.CommonApplicationData"/>
+    /// (<c>C:\ProgramData</c> on Windows, <c>/usr/share</c> or the container equivalent
+    /// elsewhere) so the credential store never lands in the launch working directory on a
+    /// non-Windows host. The production hosts override this with an explicit path in
+    /// <c>appsettings.json</c>; the validator rejects a non-rooted override.
+    /// </summary>
+    public string SqlitePath { get; init; } = Path.Combine(
+        Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData),
+        "MxGateway",
+        "gateway-auth.db");
 
     /// <summary>Gets the secret manager name for API key pepper.</summary>
     public string PepperSecretName { get; init; } = "MxGateway:ApiKeyPepper";