[Draft] Default web-service-key auth and consolidate API test fixes

[Prangshuman Das (t-prda)]

DO NOT MERGE - standalone authentication validation

AB#646383
AB#653393

This is a new branch directly from current main (efc984a5d18e7f4ef3009a1917fbfd6c057a310b), not a stacked PR and not an uptake of the SQL diagnostic branch.

Authentication

• Make Microsoft authentication the enum's DefaultImplementation, with value zero Default. Remove the hardcoded library selection and the None/no-op provider. Remove the unused explicit Microsoft Test Environment value; custom enum implementations remain supported.
• Remove 161 explicit Microsoft-provider selections from the reviewed API suites. Preserve provider-instance semantics and the final customization event.
• For on-premises NavUserPassword requests, read the current user's key and expiry, reuse a valid key (including a non-expiring key), and create a 24-hour key when missing or expired. Windows, SaaS and other modes retain ambient behavior.
• No authentication subscribers, isolated events, test-runner dependency, explicit locks, credential cache or hidden fixture commit.
• Remove the password-file writer, its cleanup hooks and the provider's Key Vault lookup. Container provisioning and test-session credentials remain intact.

Key creation can participate in an existing caller transaction. First-use visibility to the independent HTTP session remains a required runtime check; this PR does not hide a fixture commit or claim concurrent key creation for the same tenant/user is serialized.

Consolidated reviewed fixes

• Re-enable 1,059 reviewed exclusion selectors: APIV1 291, APIV2 716, Expense 51 and E-Document 1. Preserve unrelated exclusions; these counts are selectors, not executed test cases.
• Retain the reviewed stack's fixture/date/isolation, API field-comparison, localization and test-permission fixes. License-compatible dates are reapplied independently of authentication.
• Include the two coupled product fixes needed by those tests: exact Expense submitter filtering and the correct posted return-shipment PDF report usage.
• Extend existing auth test codeunit 139494 for missing-key HTTP first use, expired-key renewal, key reuse across a library reset, and fixture rollback protection. No new test codeunit or AI feature tags are introduced.

Bounded diagnostic CI

This draft intentionally skips the ordinary heavy PR build only for this branch. Run the existing CICD.yaml manually once:

• Fresh app/test builds for W1, DE, CA, US and IT, followed by their existing test build modes.
• At most six concurrent build/test matrix jobs.
• Existing four-tenant configuration unchanged; no new 1-versus-2 tenant repetition campaign.
• Zero test-app reruns, so original authentication failures remain visible.
• Current-main application artifact 30.0.55871.0 and platform 30.0.55862.0 retained. Platform PR47167 is not included.

These branch-only CI controls are diagnostic scaffolding to remove before promotion. Other branches retain their existing project selection and matrix limits.

Validation and remaining evidence

The initial run 37921988088 failed during project discovery, before any AL build or test: AL-Go retained explicitly listed project keys as supplied but normalized test-project targets to Windows separators. This revision corrects the project keys; the pinned discovery functions and all five target mappings were checked locally, including reproducing the old mismatch.

The obsolete credential PowerShell tests are deleted rather than replaced with new build-authentication code. Existing clean-tenant execution code remains unchanged. Static source/dependency checks and git diff --check pass; they are not runtime authentication evidence.

AL compilation and real-server execution are pending. The earlier web-key experiment produced 401s; local platform IL exposed an unsafe caller-transaction path, but did not establish historical causality. This PR must prove first-use cross-session visibility and fixture isolation on the target runtime. Authentication results must be classified separately from the known SQL initialization race; retries or workflow green alone are not stability evidence.

The existing expanded-API experiment and the separate fixed-platform uptake experiment remain independent.

[Prangshuman Das (t-prda)]

Superseded by the native PR stack #12697 (#12674 to #12684, all green). Closing.