Fixed inventory API pipeline: middleware ordering, JSON persistence, … (#235)

* Fixed inventory API pipeline: middleware ordering, JSON persistence, and error responses

- Fixed middleware ordering: added explicit UseRouting() before UseAntiforgery() to ensure
  endpoint metadata (DisableAntiforgery) is resolved correctly. Moved UseStatusCodePagesWithReExecute
  between UseRouting and UseAntiforgery to prevent interference with API endpoints.
- Removed redundant AddJsonFile("appsettings.json") that broke the config hierarchy by
  overriding appsettings.Development.json values.
- Fixed JSON persistence bug: removed unnecessary YAML round-trip in UpsertInventoryUseCase
  that caused data loss when clients sent JSON payloads. Merge() now accepts deserialized
  Resource objects directly instead of re-serializing to YAML.
- Changed ApiKeyEndpointFilter 503 response to include JSON body, preventing
  UseStatusCodePagesWithReExecute from intercepting bodyless status codes.

* Revert YAML pipeline changes per reviewer feedback

Restore YAML migration deserializer roundtrip in Merge() as required
for schema version migration. Keep middleware ordering fix (UseRouting
before UseAntiforgery) and API error response improvements.

---------

Co-authored-by: julian.stuch <julian.stuch@hisb-systems.de>
Co-authored-by: Tim Jones <t.jones@timmoth.com>
Co-authored-by: mavnezz <githubb.com@stuch.me>

RackPeek.Web/Api/ApiKeyEndpointFilter.cs

@@ -13,7 +13,7 @@ public class ApiKeyEndpointFilter(IConfiguration configuration) : IEndpointFilte
         var expectedKey = configuration["RPK_API_KEY"];
 
         if (string.IsNullOrWhiteSpace(expectedKey))
-            return Results.StatusCode(503);
+            return Results.Json(new { error = "API key not configured on server" }, statusCode: 503);
 
         if (!context.HttpContext.Request.Headers.TryGetValue(_apiKeyHeaderName, out StringValues providedKey)
             || !SecureEquals(providedKey.ToString(), expectedKey))

RackPeek.Web/Program.cs

@@ -17,8 +17,6 @@ public class Program {
             builder.Configuration
         );
 
-        builder.Configuration.AddJsonFile("appsettings.json", true, false);
-
         var yamlDir = builder.Configuration.GetValue<string>("RPK_YAML_DIR") ?? "./config";
         var yamlFileName = "config.yaml";
 
@@ -85,10 +83,10 @@ public class Program {
             app.UseHsts();
         }
 
-        app.UseStatusCodePagesWithReExecute("/not-found", createScopeForStatusCodePages: true);
-
         app.UseHttpsRedirection();
         app.UseStaticFiles();
+        app.UseRouting();
+        app.UseStatusCodePagesWithReExecute("/not-found", createScopeForStatusCodePages: true);
         app.UseAntiforgery();
 
         app.MapInventoryApi();

RackPeek.Web/appsettings.Development.json

@@ -4,5 +4,7 @@
       "Default": "Information",
       "Microsoft.AspNetCore": "Warning"
     }
-  }
+  },
+  "AllowedHosts": "*",
+  "RPK_API_KEY": ""
 }