feat(inbound): register AuditWriteMiddleware in pipeline (#23 M4)

src/ScadaLink.InboundAPI/EndpointExtensions.cs

@@ -5,6 +5,7 @@ using Microsoft.AspNetCore.Routing;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
+using ScadaLink.InboundAPI.Middleware;
 
 namespace ScadaLink.InboundAPI;
 
@@ -53,6 +54,13 @@ public static class EndpointExtensions
 
         var method = validationResult.Method!;
 
+        // Audit Log (#23 M4 Bundle D): publish the resolved API key name so
+        // AuditWriteMiddleware can populate AuditEvent.Actor in its finally
+        // block. Done AFTER validation succeeded — auth failures leave the
+        // slot empty and the middleware records the row with Actor=null.
+        httpContext.Items[AuditWriteMiddleware.AuditActorItemKey] =
+            validationResult.ApiKey!.Name;
+
         // WP-2: Deserialize and validate parameters
         JsonElement? body = null;
         try