dashboard: clear deferred items — EventsHub publisher + doc refresh

EventsHub publisher (closes the v2.1 follow-up flagged in the previous commit)

EventStreamService now mirrors every MxEvent it forwards to a gRPC client
into the `EventsHub` group for the session. The fan-out goes through a new
singleton `IDashboardEventBroadcaster`:

  * IDashboardEventBroadcaster — abstraction so EventStreamService doesn't
    take a direct dependency on SignalR.
  * DashboardEventBroadcaster — singleton implementation that hands the
    SendAsync to IHubContext<EventsHub> as fire-and-forget. Errors are
    logged at debug and dropped so the source gRPC stream is never
    blocked.

EventStreamService now takes IDashboardEventBroadcaster as a ctor parameter
and calls Publish(sessionId, publicEvent) once per event after sequence
filtering, before the bounded queue write. Test fixtures and the live
integration harness pass NullDashboardEventBroadcaster.Instance so the
broadcaster is a no-op in unit tests.

SessionDetailsPage adds a "Recent events" panel:
  * implements IAsyncDisposable
  * opens a second HubConnection via DashboardHubConnectionFactory targeting
    /hubs/events
  * calls SubscribeSession(SessionId) on Start
  * renders the most recent 50 events in a small table (worker seq, family,
    server/item handle, alarm reference when the event is OnAlarmTransition)
  * shows a live/offline conn-pill driven by HubConnection.Closed /
    Reconnected events

The dashboard mirror is intentionally passive — events appear only while a
gRPC client is also consuming that session's events. Documented as such in
the empty-state copy and in GatewayDashboardDesign.md.

Documentation refresh

Every doc that referenced the retired options (PathBase, RequireAdminScope,
RequiredGroup) and the old API-key-cookie auth flow is updated to describe
the new model:

  * CLAUDE.md — Authentication section now explains LDAP bind +
    GroupToRole + HubToken bearer flow.
  * gateway.md — Dashboard section: root-mounted routes, snapshot/alarms/
    events SignalR hubs, LDAP cookie + bearer scheme.
  * docs/GatewayConfiguration.md — drop PathBase / RequireAdminScope rows,
    add GroupToRole row, append "Authorization policies" and "SignalR hubs"
    subsections describing the three policies and the /hubs/* endpoints.
  * docs/GatewayDashboardDesign.md — hosting model (root mount, new
    endpoint layout), Realtime Updates rewritten as a hub table
    (DashboardSnapshotHub / AlarmsHub / EventsHub with producers, payloads,
    and routing), Authentication And Authorization rewritten around LDAP +
    role mapping + the hub bearer flow, Configuration block updated.
  * docs/GatewayProcessDesign.md — security-section dashboard paragraph
    and the example config block both refreshed to LDAP/role auth.
  * docs/ImplementationPlanGateway.md — dashboard-auth deliverable list
    updated (LDAP bind + GroupToRole + /hubs/token bearer mint replace the
    API-key login flow).
  * docs/GatewayTesting.md — DashboardLdapLiveTests blurb describes the
    GroupToRole fixture (`{ GwAdmin: Admin }`) instead of the retired
    RequiredGroup default; success-path assertion explains the role-claim
    check.

Verification: 475 server tests, 275 worker tests (+ 9 dev-rig skips), 18
integration tests (live MxAccess + LDAP + Galaxy) all pass — including the
live worker smoke test fixture that now constructs EventStreamService with
the new broadcaster parameter.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

gateway.md

@@ -112,18 +112,20 @@ histograms through .NET `Meter` and a snapshot API that dashboard services can
 project without binding to a metrics exporter.
 `DashboardSnapshotService` projects sessions, workers, metrics, faults, and
 effective configuration into immutable DTOs for read-only dashboard rendering.
-The Blazor Server dashboard renders those snapshots at `/dashboard`,
-`/dashboard/sessions`, `/dashboard/workers`, `/dashboard/events`,
-`/dashboard/galaxy`, and `/dashboard/settings`. Components subscribe to
-`IDashboardSnapshotService.WatchSnapshotsAsync()` and update on the configured
-snapshot interval without mutating session or worker state. The dashboard uses
-local Bootstrap CSS and JavaScript plus a small local stylesheet; it does not
-use a Blazor UI component library.
+The Blazor Server dashboard mounts at the host root and renders those snapshots
+at `/`, `/sessions`, `/workers`, `/events`, `/galaxy`, `/alarms`, `/apikeys`,
+and `/settings`. Pages connect to `/hubs/snapshot` (a SignalR hub published by
+`DashboardSnapshotPublisher`) and refresh on every push instead of polling.
+`/hubs/alarms` broadcasts `AlarmFeedMessage` values from the central alarm
+monitor; `/hubs/events` mirrors per-session `MxEvent` traffic from
+`EventStreamService` to clients subscribed to `session:{id}`. The dashboard
+uses local Bootstrap CSS and JavaScript plus a small local stylesheet; it does
+not use a Blazor UI component library.
 
-`/dashboard/browse` walks the `IGalaxyHierarchyCache` tree and reads subscribed
-tag values live through `IDashboardLiveDataService`, which owns one shared,
-lazily-opened gateway session for the whole dashboard. `/dashboard/alarms`
-reads the central alarm monitor's in-process cache directly. See
+`/browse` walks the `IGalaxyHierarchyCache` tree and reads subscribed tag
+values live through `IDashboardLiveDataService`, which owns one shared,
+lazily-opened gateway session for the whole dashboard. `/alarms` reads the
+central alarm monitor's in-process cache directly. See
 `docs/GatewayDashboardDesign.md`.
 
 The gateway runs an always-on central alarm monitor (`GatewayAlarmMonitor`):
@@ -138,14 +140,17 @@ session if the worker faults. Gated by `MxGateway:Alarms:Enabled` — see
 `docs/DesignDecisions.md` for why this reverses the v1 single-subscriber rule
 for the alarm subsystem.
 
-Dashboard routes use the same API-key verifier as gRPC. `/dashboard/login`
-accepts the API key in a form body, validates the configured `admin` scope,
-and issues an HTTP-only secure cookie for subsequent dashboard requests.
-`/dashboard/logout` clears that cookie. Login and logout posts validate
-anti-forgery tokens, and API keys are never accepted through query strings.
-`Dashboard:AllowAnonymousLocalhost` can bypass the cookie requirement for
-loopback requests only when explicitly enabled. Setting
-`MxGateway:Dashboard:Enabled` to `false` leaves the dashboard routes unmapped.
+Dashboard authentication is LDAP-backed (distinct from the API-key model on
+the gRPC API). `/login` accepts username and password in a form body, binds
+against `MxGateway:Ldap`, maps the user's LDAP groups to `Admin` or `Viewer`
+via `MxGateway:Dashboard:GroupToRole`, and issues an HTTP-only secure
+`__Host-MxGatewayDashboard` cookie. `/logout` clears it. Login and logout
+posts validate antiforgery tokens. SignalR hub connections accept either the
+cookie or a 30-minute data-protected bearer minted at `/hubs/token`.
+`MxGateway:Dashboard:AllowAnonymousLocalhost` permits loopback to bypass the
+cookie requirement; remote requests always require an authenticated principal
+with at least the Viewer role. Setting `MxGateway:Dashboard:Enabled` to
+`false` leaves the dashboard and hub routes unmapped.
 
 ### Worker Process