fix(gateway): harden self-signed cert persistence and config validation

src/ZB.MOM.WW.MxGateway.Server/GatewayApplication.cs

@@ -1,6 +1,7 @@
 using System.Security.Cryptography.X509Certificates;
 using Microsoft.AspNetCore.Hosting.StaticWebAssets;
 using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Configuration;
 using ZB.MOM.WW.MxGateway.Contracts;
 using ZB.MOM.WW.MxGateway.Server.Alarms;
 using ZB.MOM.WW.MxGateway.Server.Configuration;
@@ -87,7 +88,11 @@ public static class GatewayApplication
             builder.Configuration.GetSection("MxGateway:Tls").Get<Configuration.TlsOptions>()
             ?? new Configuration.TlsOptions();
 
-        using ILoggerFactory loggerFactory = LoggerFactory.Create(logging => logging.AddConsole());
+        using ILoggerFactory loggerFactory = LoggerFactory.Create(logging =>
+        {
+            logging.AddConfiguration(builder.Configuration.GetSection("Logging"));
+            logging.AddConsole();
+        });
         Security.Tls.SelfSignedCertificateProvider provider = new(
             tlsOptions,
             loggerFactory.CreateLogger<Security.Tls.SelfSignedCertificateProvider>(),
@@ -95,6 +100,8 @@ public static class GatewayApplication
 
         X509Certificate2 certificate = provider.LoadOrCreate();
         builder.WebHost.ConfigureKestrel(options =>
+            // The certificate is intentionally owned by Kestrel for the application
+            // lifetime; it is not disposed here.
             options.ConfigureHttpsDefaults(https => https.ServerCertificate = certificate));
     }