M6: REST API + API-key auth + OpenAPI

- Minimal API under /api/v1 (SDD §9): POST /readings (idempotent HA push), GET /meters,
  /energy-types, /consumption, /cost, /dashboard/summary, POST /events (records + recomputes),
  GET+POST /tariffs, GET /sources/status.
- IngestionService.IngestByMeterAsync for direct REST push (batch-safe upsert via Local cache).
- ApiKeyFilter: X-Api-Key enforced against configured keys (open only when none set).
- ReverseProxyTrust middleware: adopt X-Forwarded-User/Remote-User behind Authelia/Traefik.
- Swagger/OpenAPI (Swashbuckle) at /swagger.
- Tests: push rejected without key (401), accepted + persisted with key; meters + swagger live.

94 tests green (56 Core + 38 integration).

Claude-Session: https://claude.ai/code/session_01WujdMtMJPbxDpDnMeK22rr

src/App/Program.cs

@@ -1,3 +1,4 @@
+using MeterVault.App.Api;
 using MeterVault.App.Components;
 using MeterVault.Infrastructure;
 using MeterVault.Infrastructure.Options;
@@ -38,6 +39,10 @@ try
     builder.Services.AddRazorComponents()
         .AddInteractiveServerComponents();
 
+    builder.Services.AddEndpointsApiExplorer();
+    builder.Services.AddSwaggerGen(c =>
+        c.SwaggerDoc("v1", new() { Title = "MeterVault API", Version = "v1" }));
+
     var app = builder.Build();
 
     await MigrateDatabaseAsync(app).ConfigureAwait(false);
@@ -50,14 +55,20 @@ try
 
     app.UseStatusCodePagesWithReExecute("/not-found", createScopeForStatusCodePages: true);
     app.UseSerilogRequestLogging();
+    app.UseReverseProxyTrust();
     // No HTTPS redirection: the app serves plain HTTP (port 8080) behind a reverse proxy
     // that terminates TLS (SDD §10). HTTPS redirection here would break the container and proxy.
     app.UseAntiforgery();
 
+    app.UseSwagger();
+    app.UseSwaggerUI(c => c.SwaggerEndpoint("/swagger/v1/swagger.json", "MeterVault API v1"));
+
     app.MapStaticAssets();
     app.MapRazorComponents<App>()
         .AddInteractiveServerRenderMode();
 
+    app.MapMeterVaultApi();
+
     // Liveness/readiness probe for Gatus/Compose healthchecks (SDD §9).
     app.MapGet("/healthz", () => Results.Ok(new { status = "ok" }));