Migrate to .NET 10 with modernization pass - #3

Summary

• .NET 10 migration: all projects retargeted net9.0 → net10.0, SDK 10.0.100 in global.json, Microsoft.* packages to 10.0.0, CI workflow and cross-build Dockerfile updated
• Package hygiene: removed explicit System.Text.Json reference (framework-provided in .NET 10, NU1510); pinned Microsoft.OpenApi 2.11.0 to resolve GHSA-v5pm-xwqc-g5wc (high severity, transitive via Microsoft.AspNetCore.OpenApi)
• Access SDK modernization: System.Threading.Lock, sealed internal JsonSerializerContext classes, collection expressions — public API surface unchanged
• AccessViewer: minimal APIs grouped under /api route group with TypedResults and explicit typed response signatures for accurate OpenAPI schemas
• Test tooling: Test.Sdk 18.8.1, xunit 2.9.3, coverlet.collector 10.0.1; placeholder stubs replaced with 19 real tests (exception hierarchy, UnifiApiResponse<T>, JSON source-gen context round-trips)
• Docs: CLAUDE.md/READMEs updated to .NET 10; Linear tracking config replaced with GitHub work tracking

Verification

• Both solutions build clean: 0 warnings, 0 errors (TreatWarningsAsErrors on)
• 19/19 tests pass on net10.0
• dotnet pack produces net10.0 packages for Common + Access
• .NET 10 behavioral-change audit (dotnet/skills migration guide) — all items confirmed applied or not applicable

Correction: Native AOT publish status

An earlier version of this description claimed the Native AOT publish succeeds with zero warnings. That was wrong. dotnet publish Unifi.NET.Samples -c Release -r osx-arm64 fails, because RestSharp 112.1.0 produces IL2104 (trim) and IL3053 (AOT analysis) warnings that become errors under TreatWarningsAsErrors.

This is pre-existing and not introduced by this PR — verified by running the same publish against pre-migration main (1b4f628), which fails identically, plus an extra System.Private.Xml IL3053 that .NET 10 no longer emits. The .NET 10 state is strictly better, but still failing. Publishing Unifi.NET.Access as a library succeeds; only the AOT-compiled sample app fails. Tracked as follow-up work — see review findings below.

Review findings addressed

A code review (Grok, via Orca orchestration) raised 5 findings. Fixed in 90c5285:

• Empty IEnumerable<T> returns regressed to arrays — target-typed [] on Task<IEnumerable<T>> materializes as T[], not List<T>, so empty results silently became fixed-size and uncastable to List<T> (verified: InvalidCastException on cast, NotSupportedException on Add). Restored new List<T>() on those 9 paths; [] retained where the target is List<T> or byte[].
• Misleading test name asserting snake_case while named camelCase — renamed.

Open follow-ups (not blocking, filed for later):

• RestSharp AOT incompatibility (pre-existing, above)
• net10.0 TFM floor ships under the same VersionPrefix 3.3.21, so net9.0 consumers hit a restore failure without a SemVer signal — needs a release note or version-scheme decision
• Unifi.NET.Common exception tests are largely constructor tautologies; error-code→exception mapping is untested