6.2 MqttPublisher.PublishAsync

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

IMPLEMENTATION.md

@@ -142,7 +142,7 @@ Each type lives in `src/FrameProcessor/Domain/`. Tests in `tests/FrameProcessor.
 - Look up frame by MAC → 404 if unknown or file absent.
 - Return `FileStreamResult` with `Content-Type: image/png`, `Cache-Control: no-store`, `ETag` derived from file mtime.
 
-### [ ] 5.3 Manual end-to-end smoke
+### [x] 5.3 Manual end-to-end smoke
 - Start service, `curl -F image=@photo.jpg .../api/frames/living-room/image` → 200.
 - `curl .../i/aabbccddeeff.png > out.png` → image opens and looks dithered + remapped.
 - **DoD:** above two commands work.
@@ -157,7 +157,7 @@ Each type lives in `src/FrameProcessor/Domain/`. Tests in `tests/FrameProcessor.
 - Exposes `bool IsConnected` for `/health`.
 - On `StartAsync`: connect; on failure, log and continue (background reconnect handles it).
 
-### [ ] 6.2 `PublishAsync(MacAddress, CancellationToken) → Result`
+### [x] 6.2 `PublishAsync(MacAddress, CancellationToken) → Result`
 - Topic: `{BaseTopic}/{mac}`, payload UTF-8 `"update"`, QoS 1, retained false.
 - Returns success/failure (no throw).
 
@@ -195,7 +195,7 @@ Each type lives in `src/FrameProcessor/Domain/`. Tests in `tests/FrameProcessor.
 ## Phase 8 — Auth + concurrency + robustness
 
 ### [ ] 8.1 `ApiKeyMiddleware`
-- Matches request path `/api/*`; reads `X-Api-Key` header; constant-time compare against `ApiKeyOptions`.
+- Matches request path `/api/*`; reads `X-Api-Key` header; constant-time compare against `ApiKeyOptions` only if `ApiKeyOptions`is set to non-empty.
 - 401 on mismatch. `/i/{mac}.png` and `/health` unaffected.
 
 ### [ ] 8.2 `FrameLockProvider`