docs: add comprehensive API key testing strategy

Created detailed testing strategy documenting ArcGIS privilege system,
multi-key isolation approach, and industry security best practices.

Key components:
- Complete ArcGIS privilege inventory (50+ privileges documented)
- Four-key strategy with isolated scopes (public, location, portal, publishing)
- Test tier classification (public/standard/personal scope)
- Service-specific privilege requirements for all 12 services
- CI/CD pipeline with appropriate secret isolation
- Cost management and credit tracking guidance
- Security best practices (least privilege, rotation, no admin in tests)

Privilege system breakdown:
- Standard scope (15 privileges): Location services, safe for public apps
- Personal scope (35+ privileges): Portal operations, private apps only
- Admin scope (25+ privileges): Never use in tests

Multi-key approach:
1. Public testing: No key (uses public ArcGIS services)
2. Location services: ARCGIS_LOCATION_KEY (standard scope only)
3. Portal testing: ARCGIS_PORTAL_KEY (minimal personal scope, manual only)
4. Publishing: ARCGIS_PUBLISH_KEY (publishing only, manual only)

Security principles:
- Principle of least privilege (minimal scopes per key)
- Environmental isolation (separate keys per environment)
- No personal scope in CI (standard scope only for automation)
- Key rotation support (monthly schedule)
- Secret detection prevention (gitignore, scanners)
- Cost monitoring (credit tracking, budget alerts)

Test organization:
- tests/public/ - Tier 1, no key, CI always
- tests/location/ - Tier 2, standard scope, CI on main
- tests/portal/ - Tier 3, personal scope, manual only
- tests/publishing/ - Tier 3, publishing scope, manual only

Feature flags:
- test-public: No authentication
- test-location: ARCGIS_LOCATION_KEY
- test-portal: ARCGIS_PORTAL_KEY (manual)
- test-publishing: ARCGIS_PUBLISH_KEY (manual)

Service privilege mappings:
- Feature Service: Public queries (no key), publishing requires personal
- Map Service: Public exports (no key), basemaps require standard
- Geocoding: Temporary (standard), stored (standard + credits)
- Geometry: Public service (no key)
- Routing: All operations require standard scope
- Places: Requires premium:user:places
- Elevation: Requires premium:user:elevation
- Portal: All operations require personal scope
- Vector Tile: Public tiles (no key), basemaps require standard
- Version Management: OAuth only (enterprise)

Industry best practices implemented:
- Multiple keys for zero-downtime rotation
- Scope isolation per test tier
- Environmental separation (dev/CI/manual)
- Public service preference (40% coverage without auth)
- Never commit secrets (gitignore, scanners)
- Rate limiting and backoff
- Test cleanup (delete created resources)
- Monitoring and auditing (credit tracking, logs)

Implementation checklist:
- Phase 1: Create 4 API keys with documented scopes
- Phase 2: Reorganize tests by tier
- Phase 3: Update CI/CD (public always, location on main)
- Phase 4: Documentation (CONTRIBUTING, tests/README)
- Phase 5: Monitoring (alerts, rotation schedule)

References:
- ArcGIS API key authentication docs
- Complete privilege reference
- API key security best practices for 2026
- Google Maps Platform security guidance
- Industry API key management standards

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: crumplecup