fix: clear the open bug backlog (#473-#481, #483, #485-#487)

[JabbaKadabra]

Fixes every bug that was open on the tracker, plus the three found while doing so.

Closes #473, closes #474, closes #475, closes #476, closes #477, closes #478, closes #479, closes #480, closes #481, closes #483, closes #485, closes #486, closes #487.

#482 needs no change and can be closed as already fixed — PR #484 added IProjectAccessGuard.ResolveListScopeAsync (Proxytrace.Api/Auth/ProjectListScope.cs) and moved all eight list endpoints onto it. Verified against the current tree; not closed here because this PR touches no code for it.

Security / access control

• ProjectsController bypasses IProjectAccessGuard, defeating REST API-key project confinement #474 — ProjectsController was the only controller doing role/membership checks inline. Its CanAccessAsync never read ApiKeyAuthenticationHandler.ProjectIdItemKey, so a REST key minted for project A could list every project its owner belonged to, open project B's detail, and read project B's member email addresses — and since keys are minted by an admin, the owner usually reached every project. Now delegates to IProjectAccessGuard / ResolveListScopeAsync like the other ~15 controllers; the inline check is deleted.
• User record's generated ToString() prints PasswordHash — no PrintMembers redaction #473 — User.PrintMembers masks PasswordHash. ExternalSubject is deliberately left visible: the existing five overrides redact credentials, not identifiers (EmailSettings masks Password, prints Username).
• Session-cookie config reads a second IConfiguration that skips appsettings.{Environment}.json and inverts env-var precedence #479 — new HostEnvironmentName resolves the environment the way WebApplicationBuilder does (DOTNET_ENVIRONMENT ahead of ASPNETCORE_ENVIRONMENT), and the module layers in appsettings.{Environment}.json. The reversed order made a Production host compute Development and default the 7-day session cookie's Secure to false on an HTTPS install.

Proxy

• Proxy: non-streaming upstream body no longer bounded by the 5-minute HttpClient timeout #475 — ResponseHeadersRead is kept (the memory rationale stands), but ProxyBufferedResponseAsync re-arms the lost bound at its copy loop, sourced from client.Timeout so the header and body phases cannot drift. A stalled upstream is now a 504 recorded on the trace instead of a request, socket and continuation held open until the client gives up.
• Bounded SSE parser no longer recognizes CR-only line endings #480 — the hand-rolled splitter treats a lone \r as a terminator again, carrying the CR/LF seam across a chunk boundary so CRLF is never counted twice.

Aggregates and scoping

• Statistics aggregates cannot be scoped to several projects, so the traces overview stays empty for multi-project non-admins #483 — StatisticsFilter gained ProjectIds, mirroring what AgentCallFilter got in Unscoped list endpoints return an empty page instead of the caller's accessible rows for non-admins #482, applied in both the EF path and the raw-SQL one (= ANY(@projectIds) bound as a single uuid[] parameter, never interpolated). The single-project path is deliberately preserved, so the web UI and every REST API key keep their indexed equality predicate and its plan; only a genuine multi-project scope takes the array path. EvaluatorsController's sparkline query had the identical constraint and got the identical treatment.

Runner and middleware

• TestRunnerService: cancelling as a group completes silently skips optimizer and anomaly enqueue #476 — the success-path optimizer/anomaly enqueues take CancellationToken.None, matching the failure path. A cancel landing in the window after SetCompleted tripped the linked token and skipped both jobs silently, leaving a group reading Completed with no optimization and no anomaly detection.
• TestRunnerService: a fault after completion re-broadcasts Completed and re-enqueues anomaly detection #486 — the generic catch now broadcasts and enqueues only for a group it actually transitioned. The two success-path enqueues also absorb their own failures, so losing one no longer costs the group the other (that compensation used to happen by accident in the catch).
• ExceptionHandlingMiddleware swallows post-response exceptions, so truncated responses look complete #477 — a fault after Response.HasStarted calls context.Abort(). Returning signalled success to the framework, framing a truncated body as complete.
• Mid-stream client disconnects are captured into the Error Log at Error level #485 — a client that hung up mid-stream is classified before the error capture, so a closed browser tab no longer persists an ApplicationError carrying an errorId nobody can act on.

Pricing

• LiteLLM catalog outage causes one sequential fetch per discovered model #478 / FX-rate outage causes one fetch attempt per discovered model (same amplification as #478) #487 — the LiteLLM catalog and the Frankfurter FX feed each arm a 30s negative cache (IClock, Interlocked ticks, fast path outside the gate). Prices resolve per model, so an outage previously cost one full fetch per discovered model, serialized behind the gate — hundreds of doomed attempts for one refresh. A caller-cancelled fetch never arms it, so the recover-after-a-blip property is kept.

Misc

• ProviderEndpoints.IsAzure misclassifies fully-qualified hostnames with a trailing root dot #481 — IsAzure trims exactly one trailing DNS root dot before the exact suffix match, keeping the domain-boundary guarantee (my-azure.com.example.net still does not match).

Verification

• dotnet build Proxytrace.sln — 24 projects, 0 errors, 0 warnings
• Scoped test runs, all green: Domain 398, Storage 815, Proxy 96, Infrastructure 73, Application 523, Api 543
• manual/ VitePress build clean
• No frontend/ file changed, so no manual screenshots needed refreshing

Not verified — needs a follow-up before merge is fully clean

The two perf metrics added for #483 (statsAgentBreakdownByProjects, statsLatencyPercentilesByProjects) carry uncalibrated placeholder budgets derived from their single-project twins +25%. perf/run.sh --size 1000000 is still owed to set them from a real p95; the budget file marks them as placeholders.

One judgement call left open

StatisticsController refuses an unscoped non-admin dashboard request with an explicit 403 rather than silently returning empty, so it has no #482/#483-class defect and was left alone. It is now inconsistent with the traces overview beside it, which aggregates across the caller's projects. Making it aggregate too is a behaviour change beyond these issues.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RTyMUobDLv1aEAqHwtUtQg