Phase 7: Integration surfaces — Inbound API, External System Gateway, Notification Service

Inbound API (WP-1–5):
- POST /api/{methodName} with X-API-Key auth (401/403)
- Parameter validation with extended type system (Object, List)
- Central script execution with configurable timeout
- Route.To() cross-site calls (Call, GetAttribute/SetAttribute batch)
- Failures-only logging

External System Gateway (WP-6–10):
- HTTP/REST client with JSON, API Key + Basic Auth
- Dual call modes: Call() synchronous, CachedCall() with S&F
- Error classification (transient: 5xx/408/429, permanent: 4xx)
- Database.Connection() (ADO.NET pooling) + Database.CachedWrite() (S&F)

Notification Service (WP-11–13):
- SMTP with OAuth2 Client Credentials + Basic Auth
- BCC delivery, plain text, token lifecycle
- Transient → S&F, permanent → returned to script
- ScriptRuntimeContext wired with ExternalSystem/Database/Notify APIs

Repository implementations: ExternalSystem, Notification, InboundApi, InstanceLocator
781 tests pass, zero warnings.

src/ScadaLink.ExternalSystemGateway/ServiceCollectionExtensions.cs

@@ -11,10 +11,10 @@ public static class ServiceCollectionExtensions
             .BindConfiguration("ScadaLink:ExternalSystemGateway");
 
         services.AddHttpClient();
-        services.AddSingleton<ExternalSystemClient>();
-        services.AddSingleton<IExternalSystemClient>(sp => sp.GetRequiredService<ExternalSystemClient>());
-        services.AddSingleton<DatabaseGateway>();
-        services.AddSingleton<IDatabaseGateway>(sp => sp.GetRequiredService<DatabaseGateway>());
+        services.AddScoped<ExternalSystemClient>();
+        services.AddScoped<IExternalSystemClient>(sp => sp.GetRequiredService<ExternalSystemClient>());
+        services.AddScoped<DatabaseGateway>();
+        services.AddScoped<IDatabaseGateway>(sp => sp.GetRequiredService<DatabaseGateway>());
 
         return services;
     }