Phase 37–38: EIP onboarding docs + secret provider/throttle/multi-tenancy test hardening

[Copilot]

EIP lacked installation/onboarding documentation and had zero test coverage for AzureKeyVaultSecretProvider, VaultSecretProvider, and several core record/DTO types.

Onboarding Documentation (Phase 37, chunks 370–373)

• docs/quickstart.md — Zero-to-first-message in 15 minutes (Aspire launch → send envelope → observe in UI)
• docs/installation-guide.md — All deployment modes (Aspire, Docker Compose, Kubernetes), broker config, security, observability setup
• docs/admin-ui-guide.md — Walkthrough of all 19 Admin Dashboard pages with daily operations workflow
• docs/onboarding-checklist.md — 4-week structured program covering all 50 tutorial labs
• Updated README.md with organized documentation links

Test Hardening (Phase 38, chunks 380–383)

76 new unit tests (1919 → 1995 total). All green.

• AzureKeyVaultSecretProviderTests (16 tests) — Full CRUD coverage via mock HTTP handler: versioned reads, prefix-filtered list, null body, audit logging, argument guards
• VaultSecretProviderTests (17 tests) — HashiCorp Vault KV v2 CRUD, lease tracking, X-Vault-Token header injection, metadata merge
• InMemorySecretProviderSecretsOptionsTests (24 tests, 6 fixtures) — Audit logger integration, SecretsOptions defaults/round-trip, SecretEntry.IsExpired, SecretAuditEvent/SecretAccessAction enum coverage, SecretRotationPolicy
• ThrottleTenantRecordTests (18 tests, 6 fixtures) — ThrottlePolicy/ThrottleResult/ThrottleMetrics record semantics, TenantContext.Anonymous singleton, TenantIsolationException properties

// Example: AzureKeyVaultSecretProvider test with mock HTTP
_httpHandler.ResponseBody = JsonSerializer.Serialize(new {
    value = "my-secret",
    id = "https://myvault.vault.azure.net/secrets/db-password/v1",
    attributes = new { created = 1700000000L, exp = 1800000000L },
    tags = new Dictionary<string, string> { ["env"] = "prod" }
});
using var provider = CreateProvider();
var result = await provider.GetSecretAsync("db-password");
Assert.That(result!.Value, Is.EqualTo("my-secret"));
Assert.That(result.Version, Is.EqualTo("v1"));

Notable fix: ArgumentException.ThrowIfNullOrWhiteSpace(null) throws ArgumentNullException (not ArgumentException) — test assertions updated accordingly.