Add unit tests for MicCheck.Api.Common, exclude untestable endpoint glue

ApiKeyService had zero coverage despite real logic (key generation,
hashing, org-scoped revoke). Also filled branch gaps in AuthService
(logout with unknown token) and the auth handlers (empty header
values).

ApiKeyEndpoints/AuthEndpoints are marked [ExcludeFromCodeCoverage]:
they're minimal-API route registration that needs a live HTTP
pipeline to exercise, which CLAUDE.md disallows (no
WebApplicationFactory/InMemory). Their branch logic is already
covered via the underlying service unit tests.

Raises the namespace from 66% to 91%. Remaining gap is plain
positional records with no logic (LoginRequest, PagedResult, etc.) -
left untested per CLAUDE.md's guidance against coverage-only tests.

tests/api/MicCheck.Api.Tests.Unit/Common/Security/Authentication/ApiKeyAuthenticationHandlerTests.cs

@@ -75,6 +75,14 @@ public class ApiKeyAuthenticationHandlerTests
         Assert.That(result.None, Is.True);
     }
 
+    [Test]
+    public async Task WhenApiKeyValueIsEmpty_ThenAuthenticationFails()
+    {
+        var result = await AuthenticateAsync("Api-Key ");
+
+        Assert.That(result.Succeeded, Is.False);
+    }
+
     [Test]
     public async Task WhenApiKeyIsInvalid_ThenAuthenticationFails()
     {

tests/api/MicCheck.Api.Tests.Unit/Common/Security/Authentication/EnvironmentKeyAuthenticationHandlerTests.cs

@@ -51,6 +51,14 @@ public class EnvironmentKeyAuthenticationHandlerTests
         Assert.That(result.None, Is.True);
     }
 
+    [Test]
+    public async Task WhenEnvironmentKeyHeaderIsEmpty_ThenAuthenticationFails()
+    {
+        var result = await AuthenticateAsync("");
+
+        Assert.That(result.Succeeded, Is.False);
+    }
+
     [Test]
     public async Task WhenEnvironmentKeyIsInvalid_ThenAuthenticationFails()
     {