Merge origin/main with local pending work and update AGENTS.md references

- Resolve 14 conflicts from popping local stash on top of origin's
  eed1e88 + 8d3352f doc-comment additions (11 mechanical, plus
  version.rs, DashboardAuthenticatorTests.cs, DashboardGalaxyProjector.cs)
- Fix 4 test files that used AGENTS.md as the repo-root sentinel
  (now use CLAUDE.md, since AGENTS.md was removed in 4731ab5)
- Redirect 10 doc citations from AGENTS.md to the matching gateway.md
  sections (Value Model, Status Model, Security, STA Worker Thread
  Model, gRPC Layer rule, cancellation rule)

Verified: solution build clean, x86 worker build clean, 266/266
gateway tests passing, 121/121 worker tests passing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/MxGateway.Tests/Security/Authentication/ApiKeyAdminCliRunnerTests.cs

@@ -24,7 +24,8 @@ public sealed class ApiKeyAdminCliRunnerTests
                 Pepper: null,
                 KeyId: "operator01",
                 DisplayName: "Operator",
-                Scopes: new HashSet<string>(StringComparer.Ordinal) { "session:open", "events:read" }),
+                Scopes: new HashSet<string>(StringComparer.Ordinal) { "session:open", "events:read" },
+                Constraints: ApiKeyConstraints.Empty),
             output,
             CancellationToken.None);
 
@@ -62,7 +63,8 @@ public sealed class ApiKeyAdminCliRunnerTests
                 Pepper: null,
                 KeyId: null,
                 DisplayName: null,
-                Scopes: new HashSet<string>(StringComparer.Ordinal)),
+                Scopes: new HashSet<string>(StringComparer.Ordinal),
+                Constraints: ApiKeyConstraints.Empty),
             listOutput,
             CancellationToken.None);
 
@@ -90,7 +92,8 @@ public sealed class ApiKeyAdminCliRunnerTests
                 Pepper: null,
                 KeyId: "operator01",
                 DisplayName: null,
-                Scopes: new HashSet<string>(StringComparer.Ordinal)),
+                Scopes: new HashSet<string>(StringComparer.Ordinal),
+                Constraints: ApiKeyConstraints.Empty),
             TextWriter.Null,
             CancellationToken.None);
 
@@ -125,7 +128,8 @@ public sealed class ApiKeyAdminCliRunnerTests
                 Pepper: null,
                 KeyId: "operator01",
                 DisplayName: null,
-                Scopes: new HashSet<string>(StringComparer.Ordinal)),
+                Scopes: new HashSet<string>(StringComparer.Ordinal),
+                Constraints: ApiKeyConstraints.Empty),
             rotateOutput,
             CancellationToken.None);
 
@@ -160,7 +164,8 @@ public sealed class ApiKeyAdminCliRunnerTests
                 Pepper: null,
                 KeyId: "operator01",
                 DisplayName: "Operator",
-                Scopes: new HashSet<string>(StringComparer.Ordinal)),
+                Scopes: new HashSet<string>(StringComparer.Ordinal),
+                Constraints: ApiKeyConstraints.Empty),
             output,
             CancellationToken.None);
 
@@ -171,6 +176,41 @@ public sealed class ApiKeyAdminCliRunnerTests
         Assert.Equal(1, CountOccurrences(json, ApiKeySecret(apiKey)));
     }
 
+    [Fact]
+    public async Task CreateKeyAsync_WithConstraints_PersistsConstraints()
+    {
+        await using ServiceProvider services = BuildServices(CreateTempDatabasePath());
+        ApiKeyAdminCliRunner runner = services.GetRequiredService<ApiKeyAdminCliRunner>();
+        StringWriter output = new();
+
+        await runner.RunAsync(
+            new ApiKeyAdminCommand(
+                Kind: ApiKeyAdminCommandKind.CreateKey,
+                Json: true,
+                SqlitePath: null,
+                Pepper: null,
+                KeyId: "operator01",
+                DisplayName: "Operator",
+                Scopes: new HashSet<string>(StringComparer.Ordinal) { "metadata:read" },
+                Constraints: ApiKeyConstraints.Empty with
+                {
+                    BrowseSubtrees = ["Area1/*"],
+                    ReadAlarmOnly = true,
+                }),
+            output,
+            CancellationToken.None);
+
+        string apiKey = ReadApiKey(output.ToString());
+        ApiKeyVerificationResult verification = await services
+            .GetRequiredService<IApiKeyVerifier>()
+            .VerifyAsync($"Bearer {apiKey}", CancellationToken.None);
+
+        Assert.True(verification.Succeeded);
+        Assert.Equal(["Area1/*"], verification.Identity!.EffectiveConstraints.BrowseSubtrees);
+        Assert.True(verification.Identity.EffectiveConstraints.ReadAlarmOnly);
+    }
+
+
     private static async Task<string> CreateKeyAsync(ApiKeyAdminCliRunner runner, string keyId)
     {
         StringWriter output = new();
@@ -182,7 +222,8 @@ public sealed class ApiKeyAdminCliRunnerTests
                 Pepper: null,
                 KeyId: keyId,
                 DisplayName: "Operator",
-                Scopes: new HashSet<string>(StringComparer.Ordinal) { "session:open" }),
+                Scopes: new HashSet<string>(StringComparer.Ordinal) { "session:open" },
+                Constraints: ApiKeyConstraints.Empty),
             output,
             CancellationToken.None);
 

src/MxGateway.Tests/Security/Authentication/ApiKeyAdminCommandLineParserTests.cs

@@ -55,6 +55,42 @@ public sealed class ApiKeyAdminCommandLineParserTests
     /// <summary>
     /// Verifies create key without display name returns error.
     /// </summary>
+    [Fact]
+    public void Parse_CreateKeyCommand_ReturnsConstraints()
+    {
+        ApiKeyAdminParseResult result = ApiKeyAdminCommandLineParser.Parse(
+            [
+                "apikey",
+                "create-key",
+                "--key-id",
+                "operator01",
+                "--display-name",
+                "Operator",
+                "--read-subtree",
+                "Area1/*",
+                "--read-subtree",
+                "Area2/*",
+                "--write-tag-glob",
+                "Pump_*",
+                "--max-write-classification",
+                "2",
+                "--browse-subtree",
+                "Area1/*",
+                "--read-alarm-only",
+                "--read-historized-only"
+            ]);
+
+        Assert.True(result.IsApiKeyCommand);
+        Assert.NotNull(result.Command);
+        ApiKeyConstraints constraints = result.Command.Constraints;
+        Assert.Equal(["Area1/*", "Area2/*"], constraints.ReadSubtrees);
+        Assert.Equal(["Pump_*"], constraints.WriteTagGlobs);
+        Assert.Equal(2, constraints.MaxWriteClassification);
+        Assert.Equal(["Area1/*"], constraints.BrowseSubtrees);
+        Assert.True(constraints.ReadAlarmOnly);
+        Assert.True(constraints.ReadHistorizedOnly);
+    }
+
     [Fact]
     public void Parse_CreateKeyWithoutDisplayName_ReturnsError()
     {

src/MxGateway.Tests/Security/Authentication/ApiKeyVerifierTests.cs

@@ -145,6 +145,7 @@ public sealed class ApiKeyVerifierTests
                 "session:open",
                 "events:read"
             },
+            Constraints: ApiKeyConstraints.Empty,
             CreatedUtc: DateTimeOffset.UtcNow,
             LastUsedUtc: null,
             RevokedUtc: revokedUtc);