M6: REST API + API-key auth + OpenAPI

- Minimal API under /api/v1 (SDD §9): POST /readings (idempotent HA push), GET /meters,
  /energy-types, /consumption, /cost, /dashboard/summary, POST /events (records + recomputes),
  GET+POST /tariffs, GET /sources/status.
- IngestionService.IngestByMeterAsync for direct REST push (batch-safe upsert via Local cache).
- ApiKeyFilter: X-Api-Key enforced against configured keys (open only when none set).
- ReverseProxyTrust middleware: adopt X-Forwarded-User/Remote-User behind Authelia/Traefik.
- Swagger/OpenAPI (Swashbuckle) at /swagger.
- Tests: push rejected without key (401), accepted + persisted with key; meters + swagger live.

94 tests green (56 Core + 38 integration).

Claude-Session: https://claude.ai/code/session_01WujdMtMJPbxDpDnMeK22rr

src/Infrastructure/Options/MeterVaultOptions.cs

@@ -24,4 +24,13 @@ public sealed class MeterVaultOptions
 
     /// <summary>How long full-resolution raw readings are retained (SDD §5.5, default 3 years).</summary>
     public int RawRetentionDays { get; set; } = 1095;
+
+    /// <summary>
+    /// API keys accepted on the <c>X-Api-Key</c> header for the REST API (SDD §9). Provide via env
+    /// (e.g. <c>MeterVault__ApiKeys__0=...</c>). Empty means the API is open (dev only).
+    /// </summary>
+    public IList<string> ApiKeys { get; set; } = [];
+
+    /// <summary>Honour <c>X-Forwarded-User</c>/<c>Remote-User</c> from a trusted reverse proxy (SDD §10).</summary>
+    public bool ReverseProxyTrust { get; set; }
 }