feat(migracao-linux): hosting systemd, redes confiáveis e pipeline Linux (#575)

[elson-vinicius-lopes]

Resumo

Refs #575 (Epic: migração do runtime da LayoutParserApi de Windows para Linux). Não fecha a Epic: as Fases 1 e 2 seguem pendentes.

Por fase

• story: Fase 3 - Portar hosting da API para Linux (systemd/container) + CI/CD #578 Fase 3: UseWindowsService() só em Windows e UseSystemd() em Linux; unit deploy/linux/layoutparser-api.service com EnvironmentFile; workflows paralelos ci-dev-linux.yml e deploy-linux.yml (workflow_dispatch, os pipelines Windows não foram alterados).
• story: Fase 4 - Redesenho de confiança de identidade para topologia multi-host #579 Fase 4: nova opção Security:TrustedProxyNetworks (CIDR) no TrustedIdentityMiddleware, além do loopback. Default vazio mantém o comportamento atual. Testes em TrustedIdentityNetworksTests.
• tech-debt: Fase 5 (nota) - NÃO implementar hardening DPAPI da senha SQL, é Windows-only #580 Fase 5: runbook de hardening da senha SQL não recomenda mais DPAPI (Windows-only).
• story: Fase 1 - Inventário de compatibilidade do LayoutParserLib para runtime Linux #576 Fase 1: inventário do LayoutParserLib, só checklist (a DLL não estava disponível).
• story: Fase 2 - Contrato de sidecar Windows para processos legados (LowCodeRunner + LayoutParserDecrypt.exe) #577 Fase 2: contrato do sidecar Windows e requisitos da VM, só documentação.
• investigação: Fase 6 - eliminar dependência do LowCodeRunner proprietário (RealMapperParser/RuleInterpretor) #581 Fase 6: investigação para eliminar o LowCodeRunner, só documentação.

Avisos

• Os workflows Linux não foram validados em runner real.
• O build e a execução no Linux dependem das Fases 1 (story: Fase 1 - Inventário de compatibilidade do LayoutParserLib para runtime Linux #576) e 2 (story: Fase 2 - Contrato de sidecar Windows para processos legados (LowCodeRunner + LayoutParserDecrypt.exe) #577): LayoutParserLib.dll (net48) e LayoutParserDecrypt.exe.
• Nenhuma rede, VM ou segredo foi provisionado.

Verificação

dotnet build: 0 erros. dotnet test: 995 passaram, 0 falharam.

🤖 Generated with Claude Code

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 2 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/deploy-linux.yml

Package	Version	License	Issue Type
actions/checkout	7.*.*	Null	Unknown License
actions/setup-dotnet	6.*.*	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	7.*.*	🟢 6.4	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 5 7 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches
actions/actions/setup-dotnet	6.*.*	🟢 6.6	Details Check Score Reason Maintained 🟢 10 12 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 9 SAST tool is not run on all commits -- score normalized to 9
nuget/Microsoft.Extensions.Hosting.Systemd	10.0.12	Unknown	Unknown

Scanned Files

• .github/workflows/deploy-linux.yml
• LayoutParserApi.csproj