Merge origin/main with local pending work and update AGENTS.md references

- Resolve 14 conflicts from popping local stash on top of origin's
  eed1e88 + 8d3352f doc-comment additions (11 mechanical, plus
  version.rs, DashboardAuthenticatorTests.cs, DashboardGalaxyProjector.cs)
- Fix 4 test files that used AGENTS.md as the repo-root sentinel
  (now use CLAUDE.md, since AGENTS.md was removed in 4731ab5)
- Redirect 10 doc citations from AGENTS.md to the matching gateway.md
  sections (Value Model, Status Model, Security, STA Worker Thread
  Model, gRPC Layer rule, cancellation rule)

Verified: solution build clean, x86 worker build clean, 266/266
gateway tests passing, 121/121 worker tests passing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/MxGateway.Tests/Security/Authentication/ApiKeyAdminCliRunnerTests.cs

@@ -24,7 +24,8 @@ public sealed class ApiKeyAdminCliRunnerTests
                 Pepper: null,
                 KeyId: "operator01",
                 DisplayName: "Operator",
-                Scopes: new HashSet<string>(StringComparer.Ordinal) { "session:open", "events:read" }),
+                Scopes: new HashSet<string>(StringComparer.Ordinal) { "session:open", "events:read" },
+                Constraints: ApiKeyConstraints.Empty),
             output,
             CancellationToken.None);
 
@@ -62,7 +63,8 @@ public sealed class ApiKeyAdminCliRunnerTests
                 Pepper: null,
                 KeyId: null,
                 DisplayName: null,
-                Scopes: new HashSet<string>(StringComparer.Ordinal)),
+                Scopes: new HashSet<string>(StringComparer.Ordinal),
+                Constraints: ApiKeyConstraints.Empty),
             listOutput,
             CancellationToken.None);
 
@@ -90,7 +92,8 @@ public sealed class ApiKeyAdminCliRunnerTests
                 Pepper: null,
                 KeyId: "operator01",
                 DisplayName: null,
-                Scopes: new HashSet<string>(StringComparer.Ordinal)),
+                Scopes: new HashSet<string>(StringComparer.Ordinal),
+                Constraints: ApiKeyConstraints.Empty),
             TextWriter.Null,
             CancellationToken.None);
 
@@ -125,7 +128,8 @@ public sealed class ApiKeyAdminCliRunnerTests
                 Pepper: null,
                 KeyId: "operator01",
                 DisplayName: null,
-                Scopes: new HashSet<string>(StringComparer.Ordinal)),
+                Scopes: new HashSet<string>(StringComparer.Ordinal),
+                Constraints: ApiKeyConstraints.Empty),
             rotateOutput,
             CancellationToken.None);
 
@@ -160,7 +164,8 @@ public sealed class ApiKeyAdminCliRunnerTests
                 Pepper: null,
                 KeyId: "operator01",
                 DisplayName: "Operator",
-                Scopes: new HashSet<string>(StringComparer.Ordinal)),
+                Scopes: new HashSet<string>(StringComparer.Ordinal),
+                Constraints: ApiKeyConstraints.Empty),
             output,
             CancellationToken.None);
 
@@ -171,6 +176,41 @@ public sealed class ApiKeyAdminCliRunnerTests
         Assert.Equal(1, CountOccurrences(json, ApiKeySecret(apiKey)));
     }
 
+    [Fact]
+    public async Task CreateKeyAsync_WithConstraints_PersistsConstraints()
+    {
+        await using ServiceProvider services = BuildServices(CreateTempDatabasePath());
+        ApiKeyAdminCliRunner runner = services.GetRequiredService<ApiKeyAdminCliRunner>();
+        StringWriter output = new();
+
+        await runner.RunAsync(
+            new ApiKeyAdminCommand(
+                Kind: ApiKeyAdminCommandKind.CreateKey,
+                Json: true,
+                SqlitePath: null,
+                Pepper: null,
+                KeyId: "operator01",
+                DisplayName: "Operator",
+                Scopes: new HashSet<string>(StringComparer.Ordinal) { "metadata:read" },
+                Constraints: ApiKeyConstraints.Empty with
+                {
+                    BrowseSubtrees = ["Area1/*"],
+                    ReadAlarmOnly = true,
+                }),
+            output,
+            CancellationToken.None);
+
+        string apiKey = ReadApiKey(output.ToString());
+        ApiKeyVerificationResult verification = await services
+            .GetRequiredService<IApiKeyVerifier>()
+            .VerifyAsync($"Bearer {apiKey}", CancellationToken.None);
+
+        Assert.True(verification.Succeeded);
+        Assert.Equal(["Area1/*"], verification.Identity!.EffectiveConstraints.BrowseSubtrees);
+        Assert.True(verification.Identity.EffectiveConstraints.ReadAlarmOnly);
+    }
+
+
     private static async Task<string> CreateKeyAsync(ApiKeyAdminCliRunner runner, string keyId)
     {
         StringWriter output = new();
@@ -182,7 +222,8 @@ public sealed class ApiKeyAdminCliRunnerTests
                 Pepper: null,
                 KeyId: keyId,
                 DisplayName: "Operator",
-                Scopes: new HashSet<string>(StringComparer.Ordinal) { "session:open" }),
+                Scopes: new HashSet<string>(StringComparer.Ordinal) { "session:open" },
+                Constraints: ApiKeyConstraints.Empty),
             output,
             CancellationToken.None);