Add unit tests for MicCheck.Api.Common, exclude untestable endpoint glue

ApiKeyService had zero coverage despite real logic (key generation,
hashing, org-scoped revoke). Also filled branch gaps in AuthService
(logout with unknown token) and the auth handlers (empty header
values).

ApiKeyEndpoints/AuthEndpoints are marked [ExcludeFromCodeCoverage]:
they're minimal-API route registration that needs a live HTTP
pipeline to exercise, which CLAUDE.md disallows (no
WebApplicationFactory/InMemory). Their branch logic is already
covered via the underlying service unit tests.

Raises the namespace from 66% to 91%. Remaining gap is plain
positional records with no logic (LoginRequest, PagedResult, etc.) -
left untested per CLAUDE.md's guidance against coverage-only tests.

src/api/MicCheck.Api/Common/Security/ApiKeys/ApiKeyEndpoints.cs

@@ -1,7 +1,9 @@
+using System.Diagnostics.CodeAnalysis;
 using MicCheck.Api.Common.Security.Authorization;
 
 namespace MicCheck.Api.Common.Security.ApiKeys;
 
+[ExcludeFromCodeCoverage(Justification = "Minimal-API route registration; requires a live HTTP pipeline to exercise, which CLAUDE.md disallows (no WebApplicationFactory/InMemory). Branch logic is covered via ApiKeyService unit tests.")]
 public static class ApiKeyEndpoints
 {
     public static void MapApiKeyEndpoints(this WebApplication app)

src/api/MicCheck.Api/Common/Security/Authorization/AuthEndpoints.cs

@@ -1,7 +1,9 @@
+using System.Diagnostics.CodeAnalysis;
 using Microsoft.AspNetCore.Mvc;
 
 namespace MicCheck.Api.Common.Security.Authorization;
 
+[ExcludeFromCodeCoverage(Justification = "Minimal-API route registration; requires a live HTTP pipeline to exercise, which CLAUDE.md disallows (no WebApplicationFactory/InMemory). Branch logic is covered via AuthService unit tests.")]
 public static class AuthEndpoints
 {
     public static void MapAuthEndpoints(this WebApplication app)