[Security][Critical] Reject unknown API keys in every bootstrap configuration

[BechsteinDigital]

Severity

Critical / release blocker

Problem

ApiKeyAuthenticationHandler authenticates any non-empty API-key header as platform superadmin when bootstrap keys are enabled and RequireApiKeyAuthentication is false.

The current branch is effectively:

EnableBootstrapApiKeys &&
(!RequireApiKeyAuthentication || IsKnownBootstrapKey(providedKey))

The “require header” setting must never change whether a presented credential is valid.

Evidence

• src/Core/Infrastructure/Security/ApiKeyAuthenticationHandler.cs:52
• src/Core/Infrastructure/Security/BackendSecurityServiceCollectionExtensions.cs:50
• src/Core/Application/Policies/BackendHostOptions.cs:75

Acceptance criteria

• Every presented API key is validated against a known credential.
• RequireApiKeyAuthentication only controls authentication-policy behavior, never credential validity.
• Unknown keys return 401 for every configuration permutation.
• A configuration-matrix test covers bootstrap on/off and require-authentication on/off.
• Bootstrap credentials can be disabled/retired after onboarding.
• Documentation states the exact safe bootstrap lifecycle.