Phase 36: Auth, Observability & System Management Test Hardening (+33 unit tests)

[Copilot]

Audit identified zero dedicated tests for ApiKeyAuthenticationHandler (security-critical), LokiObservabilityEventLog (observability event storage with Loki HTTP + in-memory fallback), ControlBusPublisher (EIP Control Bus pattern), and DlqManagementService (DLQ replay). UnitTests: 1886 → 1919.

Chunk 360 — ApiKeyAuthenticationHandler (10 tests)

• Missing header, invalid key, valid key with Admin role / Name / apikey_prefix claims
• Case-sensitive ordinal comparison, multiple configured keys, empty config rejection, short key masking (****)
• Added InternalsVisibleTo("UnitTests") to Admin.Api.csproj (handler is internal sealed)
• Added FrameworkReference Microsoft.AspNetCore.App to UnitTests.csproj

Chunk 361 — LokiObservabilityEventLog (11 tests)

• RecordAsync: Loki push endpoint, swallows HTTP errors without rethrowing, always persists to static fallback store
• GetByCorrelationId / GetByBusinessKey: Loki query_range parsing, fallback on failure, case-insensitive business key match
• Uses MockLokiHandler (DelegatingHandler) with separate push/query status codes; reflection clears static FallbackStore in [SetUp]

Chunk 362 — ControlBusPublisher & DlqManagementService (12 tests)

• PublishCommandAsync: success result, topic routing, MessageIntent.Command on envelope, producer exception → Succeeded=false
• SubscribeAsync: consumer registration on control topic, command type filtering
• Argument guards: null command/handler, empty command type, null producer/consumer constructors
• DlqManagementService: delegates to IMessageReplayer, passes ReplayFilter through

// Example: ControlBusPublisher wraps commands with Command intent
var result = await _sut.PublishCommandAsync<object>(
    new { Action = "restart" }, "RestartService");
Assert.That(capturedIntent, Is.EqualTo(MessageIntent.Command));
Assert.That(result.ControlTopic, Is.EqualTo("test.control"));