feat: Phase 2 — Delegated State, Auth, Review-Gate, Notifications, Zombie-Reset

backend/Extensions/ApplicationBuilderExtensions.cs

@@ -68,6 +68,7 @@ public static class ApplicationBuilderExtensions
     {
         app.UseForwardedHeaders();
         app.UseRateLimiter();
+        app.UseApiKeyAuthentication();
         app.UseAuthentication();
         app.UseAuthorization();
         app.UseSecurityHeaders();

backend/Extensions/ServiceCollectionExtensions.cs

@@ -170,6 +170,7 @@ public static class ServiceCollectionExtensions
     /// </summary>
     public static IServiceCollection AddNexusApplicationServices(this IServiceCollection services)
     {
+        services.AddHttpContextAccessor();
         services.AddTransient<ModelRoutingService>();
         services.AddScoped<IAuthService, AuthService>();
         services.AddScoped<IAgentService, AgentService>();
@@ -182,6 +183,7 @@ public static class ServiceCollectionExtensions
         services.AddSingleton<IMemoryService, MemoryService>();
         services.AddSingleton<IIncidentService, IncidentService>();
         services.AddSingleton<IDocService, DocService>();
+        services.AddScoped<INotificationService, NotificationService>();
         services.AddScoped<ICalendarService, CalendarService>();
 
         return services;