Fix tenant warmup and fallback DataProtection key ring

[windischb]

Summary

• resolve the OAuth LINQ warmup service only inside an active tenant scope
• keep ASP.NET Core's unused root DataProtection key manager inert
• retain the real per-realm Marten key rings and correct their stale documentation
• add a regression test for the inert root key manager

Verification

• dotnet test src/dotnet/Modgud.Tests.Unit/Modgud.Tests.Unit.csproj -c Release --no-restore — 1,453 passed
• dotnet test src/dotnet/Modgud.slnx -c Release --no-build — 2,028 passed
• full Docker image build succeeded
• fresh Production container against the existing realm DB returned health 200
• no tenant-less warmup error, filesystem key-ring warning, XML-encryptor warning, or fallback key file
• the intentional warning about unencrypted-at-rest Marten keys remains