M6: REST API + API-key auth + OpenAPI

- Minimal API under /api/v1 (SDD §9): POST /readings (idempotent HA push), GET /meters,
  /energy-types, /consumption, /cost, /dashboard/summary, POST /events (records + recomputes),
  GET+POST /tariffs, GET /sources/status.
- IngestionService.IngestByMeterAsync for direct REST push (batch-safe upsert via Local cache).
- ApiKeyFilter: X-Api-Key enforced against configured keys (open only when none set).
- ReverseProxyTrust middleware: adopt X-Forwarded-User/Remote-User behind Authelia/Traefik.
- Swagger/OpenAPI (Swashbuckle) at /swagger.
- Tests: push rejected without key (401), accepted + persisted with key; meters + swagger live.

94 tests green (56 Core + 38 integration).

Claude-Session: https://claude.ai/code/session_01WujdMtMJPbxDpDnMeK22rr

tests/Integration.Tests/MeterVaultAppFactory.cs

@@ -9,11 +9,14 @@ namespace MeterVault.Integration.Tests;
 /// </summary>
 public sealed class MeterVaultAppFactory(string connectionString) : WebApplicationFactory<Program>
 {
+    public const string ApiKey = "test-api-key";
+
     protected override void ConfigureWebHost(IWebHostBuilder builder)
     {
         builder.UseEnvironment("Testing");
         builder.UseSetting("ConnectionStrings:Default", connectionString);
         builder.UseSetting("MeterVault:RunMigrationsAtStartup", "false");
         builder.UseSetting("MeterVault:EnableLiveIngestion", "false");
+        builder.UseSetting("MeterVault:ApiKeys:0", ApiKey);
     }
 }