fix tests. new product advisories enhancements

src/Registry/StellaOps.Registry.TokenService/Admin/InMemoryPlanRuleStore.cs

@@ -198,6 +198,7 @@ public sealed class InMemoryPlanRuleStore : IPlanRuleStore
 
         var result = query
             .OrderByDescending(e => e.Timestamp)
+            .ThenBy(e => e.Id, StringComparer.Ordinal)
             .Skip((page - 1) * pageSize)
             .Take(pageSize)
             .ToList();

src/Registry/__Tests/StellaOps.Registry.TokenService.Tests/Admin/InMemoryPlanRuleStoreTests.cs

@@ -342,7 +342,7 @@ public sealed class InMemoryPlanRuleStoreTests
         Assert.Null(createEntry.PreviousVersion);
         Assert.Equal(1, createEntry.NewVersion);
 
-        var updateEntries = history.Where(e => e.Action == "Updated").OrderBy(e => e.Timestamp).ToList();
+        var updateEntries = history.Where(e => e.Action == "Updated").OrderBy(e => e.Timestamp).ThenBy(e => e.Id, StringComparer.Ordinal).ToList();
         Assert.Equal(1, updateEntries[0].PreviousVersion);
         Assert.Equal(2, updateEntries[0].NewVersion);
         Assert.Equal(2, updateEntries[1].PreviousVersion);

src/Registry/__Tests/StellaOps.Registry.TokenService.Tests/Admin/PlanAdminEndpointsTests.cs

@@ -10,6 +10,7 @@ using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Mvc.Testing;
 using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
@@ -316,12 +317,44 @@ public sealed class PlanAdminEndpointsTests : IClassFixture<PlanAdminEndpointsTe
 
     public sealed class TestWebApplicationFactory : WebApplicationFactory<Program>
     {
+        private string? _tempKeyPath;
+
         protected override void ConfigureWebHost(IWebHostBuilder builder)
         {
             builder.UseEnvironment("Development");
 
+            // Create a temporary RSA key file for signing validation
+            _tempKeyPath = Path.Combine(Path.GetTempPath(), $"test-key-{Guid.NewGuid():N}.pem");
+            File.WriteAllText(_tempKeyPath, TestRsaKey);
+
+            // Use UseSetting to inject configuration values that are available
+            // during Program.Main execution (before DI container is built)
+            builder.UseSetting($"{RegistryTokenServiceOptions.SectionName}:Authority:Issuer", "https://localhost:5001");
+            builder.UseSetting($"{RegistryTokenServiceOptions.SectionName}:Authority:RequireHttpsMetadata", "false");
+            builder.UseSetting($"{RegistryTokenServiceOptions.SectionName}:Signing:Issuer", "https://registry.test.local");
+            builder.UseSetting($"{RegistryTokenServiceOptions.SectionName}:Signing:KeyPath", _tempKeyPath);
+            builder.UseSetting($"{RegistryTokenServiceOptions.SectionName}:Signing:Lifetime", "00:05:00");
+            builder.UseSetting($"{RegistryTokenServiceOptions.SectionName}:Registry:Realm", "https://registry.test.local/v2/token");
+            builder.UseSetting($"{RegistryTokenServiceOptions.SectionName}:Plans:0:Name", "default");
+            builder.UseSetting($"{RegistryTokenServiceOptions.SectionName}:Plans:0:Repositories:0:Pattern", "*");
+            builder.UseSetting($"{RegistryTokenServiceOptions.SectionName}:Plans:0:Repositories:0:Actions:0", "pull");
+
+            // Disable telemetry collector to avoid OpenTelemetry instrumentation conflicts in tests
+            builder.UseSetting("Telemetry:Collector:Enabled", "false");
+
             builder.ConfigureTestServices(services =>
             {
+                // Remove OpenTelemetry hosted services that conflict with WebApplicationFactory
+                var otelDescriptors = services
+                    .Where(d => d.ServiceType.FullName?.Contains("OpenTelemetry") == true
+                             || d.ImplementationType?.FullName?.Contains("OpenTelemetry") == true
+                             || d.ImplementationType?.FullName?.Contains("TelemetryHostedService") == true)
+                    .ToList();
+                foreach (var descriptor in otelDescriptors)
+                {
+                    services.Remove(descriptor);
+                }
+
                 // Replace TimeProvider with fake for deterministic tests
                 services.AddSingleton<TimeProvider>(new FakeTimeProvider(
                     new DateTimeOffset(2025, 1, 15, 10, 0, 0, TimeSpan.Zero)));
@@ -349,6 +382,15 @@ public sealed class PlanAdminEndpointsTests : IClassFixture<PlanAdminEndpointsTe
             });
         }
 
+        protected override void Dispose(bool disposing)
+        {
+            base.Dispose(disposing);
+            if (_tempKeyPath is not null && File.Exists(_tempKeyPath))
+            {
+                try { File.Delete(_tempKeyPath); } catch { /* best effort cleanup */ }
+            }
+        }
+
         public HttpClient CreateAuthenticatedClient()
         {
             var client = CreateClient();
@@ -356,6 +398,37 @@ public sealed class PlanAdminEndpointsTests : IClassFixture<PlanAdminEndpointsTe
                 new System.Net.Http.Headers.AuthenticationHeaderValue("Test");
             return client;
         }
+
+        // Minimal RSA private key in PEM format for test purposes
+        private const string TestRsaKey = """
+            -----BEGIN RSA PRIVATE KEY-----
+            MIIEowIBAAKCAQEA0Z3VS5JJcds3xfn/ygWep4PAtGoRBK4DPq3JOuGBnPBSh3Rq
+            JMaXWJMfSGS9Tt49eTf1oB0bsetBPu0G+YpOEHU2KlgV+SMU6rXbAbgUHFBM3P6A
+            S49iW6PGpkeewC/okycCZtU0FrqS+GIloWs7GnJQfvHzBPIgQB6FP5xPnOEe6kbz
+            JiN3kQ1S6QJ1JT8Tv/0WPjhQcW0PM4xk9PXNP5sQIpocjkLmB1xzy6lXG2CE9bT
+            LBQkPDjj9VjG6GfGrqSvUCaY2LQqgE3Nrw57wQpGMqQw0ib7MimAqrz4VH77KFU
+            lVeyZlPfjZUNfQIDA4RQBHY8A4Gj0n3bDD7SJQIDAQABAoIBAFzNuJDSFQQnpWuN
+            E4r8l6gNvOmH16n1GR3R2rVLJJ0Y0Y/AMQGT1+eMBjlCRBdaMC/KYbxkFqMwGaP3
+            t2S9d7bUjN47GaG/YC7FDeaR7dDG7sHKjcKl3+3JI4i6PSN7dPD5Y8hYuE/4Y+d8
+            T1rnYVQ0FP9oHzZwJfn9Z+Jm9qb7G4T1y9mpqOUzqvCAD4CdIrRkZ+XpVqc0JEF
+            YbJJRAC9Yc0nBdz7W8m7a8ipGviT7CDVAfQK0u2rkZyfZ+bnkBkMPGy+O8T8VRRe
+            1MiZA9hfN82vWvnPlI7nFgb0JIbhFGvf5hR4HKOD9iDGqE+RD4LgR0pXawMWaKUG
+            H7EYG6ECgYEA8dBi/2rFXnVPLTEpLXSm3n19VPxDCgyS5/HfkRKnIj1djBqfoXkr
+            Ipm2VZ1bVxOuzK87BSRP3Ysr5qAXjNDR9dIRZAe/Q9j9z1dvfIRfVLA0dcL0bYm
+            6aSbFNyia8eRlBcZu2V4JBq3gM6MBo/GFfWVQLux8d+MDnM4K0vAlECgYEA3Wz+
+            UjGHU7aPbR2+2p0Dq9VsCU7T5PBiXR/bDsZILAitFRKD0kn6sLRIy47Fz9wBxD3l
+            ZMtQarHINhB3gY6xMBXf4s//XnRp4J/gGVjDBbRv1pO0BFV2MAoC2ux22Kmbrg4B
+            GqfWGK+Vk5G0o7b9P9KjCPr+nvB/bfKpDSj3jUCgYBk6p8CqXqVU0Q7PoEqEPcA
+            r7bwuU8+vMN5GfG7j5tYXnk4K9kiVLN8RIQK8mFBFfXhN5J/pq+1kI7+CPT0aN0
+            T9tFq1VHcG+k+T3BAPZL2DP7z/sP6ggbTf2MOjRE7QDN/2bYqEa5KK0X0pBmsN3
+            s2CQ4Q8Z3Lk/YpO0PKNiIQKBgGtO0DP4j+BIF3C+4FJ+xG4rbHLxAjAPlabfF7n
+            X0oYblKl82g/vMxl5jqlxTEfR0xpt4J5ikPl+L7JNQ/1AK4G5K7VJj+tv1NcmEqV
+            M0BIAC3F0fGQ8JE2JHi1D+nh0Xf+zy5J+1vJD5ckixGV7jwH5Al9Fqcwg5KF+6S
+            c2QxAoGBAJM/5kkEFuLG5cP0cBnEOKR5i/JqhYjXlIC0R6TbXlazaNZ4P4JU+Fxv
+            wM7W2vLHrVFNZv0fE/1R/cBhJaQ5sQm5YfxAYsLhVX7UGFJl1VIg2+BnJJNqh4fQ
+            Ui/YBCxBFTHF6BbEnJ8TxFQq9X/2anwDPvU+ISqw/lW4n7pPRIgF
+            -----END RSA PRIVATE KEY-----
+            """;
     }
 
     private sealed class TestAuthHandler : AuthenticationHandler<AuthenticationSchemeOptions>