feat(lmxproxy): phase 7 — integration tests, deployment to windev, v1 cutover

- Replaced STA dispatch thread with Task.Run pattern for COM interop
- Fixed TypedValue oneof tracking with property-level _setCase field
- Added x-api-key DelegatingHandler for gRPC metadata authentication
- Fixed CheckApiKey RPC to validate request body key (not header)
- Integration tests: 15/17 pass (reads, subscribes, API keys, connections)
- 2 write tests pending (OnWriteComplete callback timing issue)
- v2 service deployed on windev port 50100

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lmxproxy/src/ZB.MOM.WW.LmxProxy.Host/Grpc/Services/ScadaGrpcService.cs

@@ -8,6 +8,7 @@ using Serilog;
 using ZB.MOM.WW.LmxProxy.Host.Domain;
 using ZB.MOM.WW.LmxProxy.Host.Metrics;
 using ZB.MOM.WW.LmxProxy.Host.Sessions;
+using ZB.MOM.WW.LmxProxy.Host.Security;
 using ZB.MOM.WW.LmxProxy.Host.Subscriptions;
 
 namespace ZB.MOM.WW.LmxProxy.Host.Grpc.Services
@@ -24,17 +25,20 @@ namespace ZB.MOM.WW.LmxProxy.Host.Grpc.Services
         private readonly SessionManager _sessionManager;
         private readonly SubscriptionManager _subscriptionManager;
         private readonly PerformanceMetrics? _performanceMetrics;
+        private readonly ApiKeyService? _apiKeyService;
 
         public ScadaGrpcService(
             IScadaClient scadaClient,
             SessionManager sessionManager,
             SubscriptionManager subscriptionManager,
-            PerformanceMetrics? performanceMetrics = null)
+            PerformanceMetrics? performanceMetrics = null,
+            ApiKeyService? apiKeyService = null)
         {
             _scadaClient = scadaClient;
             _sessionManager = sessionManager;
             _subscriptionManager = subscriptionManager;
             _performanceMetrics = performanceMetrics;
+            _apiKeyService = apiKeyService;
         }
 
         // -- Connection Management ------------------------------------
@@ -390,10 +394,8 @@ namespace ZB.MOM.WW.LmxProxy.Host.Grpc.Services
         public override Task<Scada.CheckApiKeyResponse> CheckApiKey(
             Scada.CheckApiKeyRequest request, ServerCallContext context)
         {
-            // The interceptor already validated the x-api-key header.
-            // This RPC lets clients explicitly check a specific key.
-            // The validated key from the interceptor is in context.UserState.
-            var isValid = context.UserState.ContainsKey("ApiKey");
+            // Check the API key from the request body against the key store.
+            var isValid = _apiKeyService != null && _apiKeyService.ValidateApiKey(request.ApiKey) != null;
             return Task.FromResult(new Scada.CheckApiKeyResponse
             {
                 IsValid = isValid,