M6: REST API + API-key auth + OpenAPI

- Minimal API under /api/v1 (SDD §9): POST /readings (idempotent HA push), GET /meters,
  /energy-types, /consumption, /cost, /dashboard/summary, POST /events (records + recomputes),
  GET+POST /tariffs, GET /sources/status.
- IngestionService.IngestByMeterAsync for direct REST push (batch-safe upsert via Local cache).
- ApiKeyFilter: X-Api-Key enforced against configured keys (open only when none set).
- ReverseProxyTrust middleware: adopt X-Forwarded-User/Remote-User behind Authelia/Traefik.
- Swagger/OpenAPI (Swashbuckle) at /swagger.
- Tests: push rejected without key (401), accepted + persisted with key; meters + swagger live.

94 tests green (56 Core + 38 integration).

Claude-Session: https://claude.ai/code/session_01WujdMtMJPbxDpDnMeK22rr

tests/Integration.Tests/ApiTests.cs

@@ -0,0 +1,71 @@
+using System.Net;
+using System.Net.Http.Json;
+using MeterVault.Core.Domain;
+using MeterVault.Infrastructure.Persistence;
+using Microsoft.EntityFrameworkCore;
+
+namespace MeterVault.Integration.Tests;
+
+[Collection("Timescale")]
+public sealed class ApiTests(TimescaleFixture fx)
+{
+    private sealed record ReadingPush(int MeterId, DateTimeOffset Time, double Value);
+
+    [Fact]
+    public async Task Readings_push_requires_key_and_writes_when_authorized()
+    {
+        int meterId;
+        await using (var db = fx.CreateContext())
+        {
+            await DatabaseSeeder.SeedAsync(db);
+            var type = await db.EnergyTypes.FirstAsync(t => t.Key == "electricity");
+            var meter = new Meter { Name = $"api-{Guid.NewGuid():N}", EnergyTypeId = type.Id, Mode = MeterMode.CumulativeCounter, Unit = "kWh" };
+            db.Meters.Add(meter);
+            await db.SaveChangesAsync();
+            meterId = meter.Id;
+        }
+
+        using var factory = new MeterVaultAppFactory(fx.ConnectionString);
+        using var client = factory.CreateClient();
+
+        var push = new[] { new ReadingPush(meterId, new DateTimeOffset(2024, 5, 1, 0, 0, 0, TimeSpan.Zero), 1500) };
+
+        // Without the key → 401.
+        var unauthorized = await client.PostAsJsonAsync("/api/v1/readings", push);
+        Assert.Equal(HttpStatusCode.Unauthorized, unauthorized.StatusCode);
+
+        // With the key → 200 and the reading is persisted.
+        using var request = new HttpRequestMessage(HttpMethod.Post, "/api/v1/readings")
+        {
+            Content = JsonContent.Create(push),
+        };
+        request.Headers.Add("X-Api-Key", MeterVaultAppFactory.ApiKey);
+        var authorized = await client.SendAsync(request);
+        authorized.EnsureSuccessStatusCode();
+
+        await using (var db = fx.CreateContext())
+        {
+            var reading = await db.Readings.SingleAsync(r => r.MeterId == meterId);
+            Assert.Equal(1500, reading.Value, 3);
+            await db.Readings.Where(r => r.MeterId == meterId).ExecuteDeleteAsync();
+            await db.Meters.Where(m => m.Id == meterId).ExecuteDeleteAsync();
+        }
+    }
+
+    [Fact]
+    public async Task Meters_endpoint_and_swagger_are_available()
+    {
+        using var factory = new MeterVaultAppFactory(fx.ConnectionString);
+        using var client = factory.CreateClient();
+
+        using var metersRequest = new HttpRequestMessage(HttpMethod.Get, "/api/v1/meters");
+        metersRequest.Headers.Add("X-Api-Key", MeterVaultAppFactory.ApiKey);
+        var meters = await client.SendAsync(metersRequest);
+        meters.EnsureSuccessStatusCode();
+
+        // Swagger document is served (no API key required).
+        var swagger = await client.GetAsync(new Uri("/swagger/v1/swagger.json", UriKind.Relative));
+        swagger.EnsureSuccessStatusCode();
+        Assert.Contains("MeterVault API", await swagger.Content.ReadAsStringAsync(), StringComparison.Ordinal);
+    }
+}

tests/Integration.Tests/MeterVaultAppFactory.cs

@@ -9,11 +9,14 @@ namespace MeterVault.Integration.Tests;
 /// </summary>
 public sealed class MeterVaultAppFactory(string connectionString) : WebApplicationFactory<Program>
 {
+    public const string ApiKey = "test-api-key";
+
     protected override void ConfigureWebHost(IWebHostBuilder builder)
     {
         builder.UseEnvironment("Testing");
         builder.UseSetting("ConnectionStrings:Default", connectionString);
         builder.UseSetting("MeterVault:RunMigrationsAtStartup", "false");
         builder.UseSetting("MeterVault:EnableLiveIngestion", "false");
+        builder.UseSetting("MeterVault:ApiKeys:0", ApiKey);
     }
 }