feat(localdb)!: replicate site config + sf_messages via CDC, delete the bespoke replicators

Tasks 14, 15 and 16, landed as ONE commit.

PLAN DEFECT: these three tasks cannot compile separately. SiteReplicationActor
takes a ReplicationService and calls ReplaceAllAsync (Task 14 deletes both);
DeploymentManagerActor Tells message types declared in ReplicationMessages.cs
(Task 15 deletes it); AkkaHostedService constructs the actor (Task 16). Any
ordering leaves a broken intermediate. Combining them also strengthens the
invariant Task 14 already stated for itself — the two mechanisms never both
run, and never neither.

Registered 8 tables in SiteLocalDbSetup.OnReady: sf_messages plus the 7 site
config tables. notification_lists and smtp_configurations are deliberately NOT
registered — permanently empty by design, so registering them would open a
standing replication channel whose only historical payload was plaintext SMTP
passwords. Migrate stays the LAST call in OnReady, after all registrations, so
migrated rows enter the oplog through live capture triggers.

Deleted: SiteReplicationActor, ReplicationMessages.cs, ReplicationService,
StoreAndForwardStorage.ReplaceAllAsync, and 6 test files. ReplaceAllAsync is
not merely unused but unsafe to keep: a mass DELETE on a now-replicated table
would be captured and shipped to the peer.

Kept ActiveNodeEvaluator (delivery gate + heartbeat still need it) with its doc
corrected, and activeNodeCheck in AkkaHostedService (SiteCommunicationActor).

The positional-argument hazard the plan flagged was real: removing
DeploymentManagerActor's optional IActorRef? replicationActor shifted 6
trailing optionals, and 4 test call sites bound the wrong arguments with no
compile error at some positions. Converted them to named arguments where
possible — Props.Create builds an expression tree, which rejects out-of-position
named args, so the rest are padded positionally with a comment saying why.

The Task 7 'not yet registered' test was INVERTED rather than deleted, and is
exact in both directions: too few means a table silently stops replicating, too
many means the SMTP tables leak. Added a separate security-named test for those
two, and a composite-PK test (LWW keys on the full PK, so a truncated key set
would collapse distinct rows). The convergence suites now get their
registrations from the real OnReady — their temporary harness registration is
deleted, so they prove the cutover rather than agreeing with themselves.

Verified: build 0 warnings; SiteRuntime 512, StoreAndForward 130, Host 330,
AuditLog 355, ExternalSystemGateway 142, HealthMonitoring 97, LocalDb
integration 16 — all pass, 0 failures.

Claude-Session: https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts

src/ZB.MOM.WW.ScadaBridge.StoreAndForward/StoreAndForwardService.cs

@@ -36,7 +36,6 @@ public class StoreAndForwardService
 {
     private readonly StoreAndForwardStorage _storage;
     private readonly StoreAndForwardOptions _options;
-    private readonly ReplicationService? _replication;
     private readonly ILogger<StoreAndForwardService> _logger;
     /// <summary>
     /// Site-side observer notified
@@ -107,7 +106,7 @@ public class StoreAndForwardService
     /// <c>null</c> when no sweep is currently running. Captured when the timer
     /// callback starts a sweep so <see cref="StopAsync"/> can wait for it to
     /// finish before the host disposes downstream dependencies
-    /// (<see cref="_storage"/>, <see cref="_replication"/>) that the sweep is
+    /// (<see cref="_storage"/>) that the sweep is
     /// still touching. Written from the timer thread and from
     /// <see cref="StopAsync"/>, so reads are synchronised via the
     /// <see cref="Volatile"/> APIs.
@@ -227,7 +226,6 @@ public class StoreAndForwardService
     /// <param name="storage">The storage backend for buffered messages.</param>
     /// <param name="options">Configuration options.</param>
     /// <param name="logger">Logger instance.</param>
-    /// <param name="replication">Optional replication service for standby synchronization.</param>
     /// <param name="cachedCallObserver">Optional observer for cached call lifecycle events.</param>
     /// <param name="siteId">The site identifier this service belongs to.</param>
     /// <param name="siteEventLogger">
@@ -240,7 +238,6 @@ public class StoreAndForwardService
         StoreAndForwardStorage storage,
         StoreAndForwardOptions options,
         ILogger<StoreAndForwardService> logger,
-        ReplicationService? replication = null,
         ICachedCallLifecycleObserver? cachedCallObserver = null,
         string siteId = "",
         ISiteEventLogger? siteEventLogger = null)
@@ -248,7 +245,6 @@ public class StoreAndForwardService
         _storage = storage;
         _options = options;
         _logger = logger;
-        _replication = replication;
         _cachedCallObserver = cachedCallObserver;
         _siteId = string.IsNullOrWhiteSpace(siteId) ? UnknownSiteSentinel : siteId;
         _siteEventLogger = siteEventLogger;
@@ -651,7 +647,6 @@ public class StoreAndForwardService
     private async Task BufferAsync(StoreAndForwardMessage message)
     {
         await _storage.EnqueueAsync(message);
-        _replication?.ReplicateEnqueue(message);
         Interlocked.Increment(ref _bufferedCount);
     }
 
@@ -802,7 +797,6 @@ public class StoreAndForwardService
             if (success)
             {
                 await _storage.RemoveMessageAsync(message.Id);
-                _replication?.ReplicateRemove(message.Id);
                 Interlocked.Decrement(ref _bufferedCount);
                 RaiseActivity("Delivered", message.Category,
                     $"Delivered to {message.Target} after {message.RetryCount} retries");
@@ -833,7 +827,6 @@ public class StoreAndForwardService
                 return RetryOutcome.Skipped;
             }
             Interlocked.Decrement(ref _bufferedCount);
-            _replication?.ReplicatePark(message);
             RaiseActivity("Parked", message.Category,
                 $"Permanent failure for {message.Target}: handler returned false");
 
@@ -869,7 +862,6 @@ public class StoreAndForwardService
                     return RetryOutcome.Skipped;
                 }
                 Interlocked.Decrement(ref _bufferedCount);
-                _replication?.ReplicatePark(message);
                 RaiseActivity("Parked", message.Category,
                     $"Max retries ({message.MaxRetries}) reached for {message.Target}");
                 _logger.LogWarning(
@@ -1077,17 +1069,12 @@ public class StoreAndForwardService
     /// <summary>
     /// Retries a parked message (moves back to pending queue).
     ///
-    /// An operator requeue is a buffer state change and is
-    /// replicated to the standby (as a <see cref="ReplicationOperationType.Requeue"/>)
-    /// so a failover preserves the operator's retry intent.
+    /// An operator requeue is a buffer state change, and the peer picks it up because
+    /// <c>sf_messages</c> is a replicated table: the row update is captured and shipped
+    /// like any other write, so a failover preserves the operator's retry intent. This
+    /// used to be an explicit Requeue operation sent to the standby.
     /// The activity-log entry carries the message's true
     /// category rather than a hard-coded one.
-    /// The parked row is captured <i>before</i> the local
-    /// requeue write rather than re-read after it, so a concurrent
-    /// <c>RemoveMessageAsync</c> or <c>DiscardParkedMessageAsync</c> running
-    /// between the two storage calls cannot leave the standby in <c>Parked</c>
-    /// while the active node has already requeued — we always have the row in
-    /// hand for the <c>Requeue</c> replication.
     /// </summary>
     /// <param name="messageId">The identifier of the message to retry.</param>
     /// <returns>True if successfully retried, false otherwise.</returns>
@@ -1117,7 +1104,6 @@ public class StoreAndForwardService
         captured.RetryCount = 0;
         captured.LastError = null;
         captured.LastAttemptAt = null;
-        _replication?.ReplicateRequeue(captured);
 
         RaiseActivity("Retry", captured.Category,
             $"Parked message {messageId} moved back to queue");
@@ -1127,9 +1113,10 @@ public class StoreAndForwardService
     /// <summary>
     /// Permanently discards a parked message.
     ///
-    /// An operator discard is a buffer removal and is replicated
-    /// to the standby (as a <see cref="ReplicationOperationType.Remove"/>) so the
-    /// discarded message does not reappear after a failover.
+    /// An operator discard is a buffer removal. The delete is captured as a tombstone on
+    /// the replicated <c>sf_messages</c> table and carries the later HLC, so the discarded
+    /// message cannot reappear after a failover regardless of arrival order. This used to
+    /// be an explicit Remove operation sent to the standby.
     /// The activity-log entry carries the message's true
     /// category rather than a hard-coded one.
     /// </summary>
@@ -1143,7 +1130,6 @@ public class StoreAndForwardService
         var success = await _storage.DiscardParkedMessageAsync(messageId);
         if (success)
         {
-            _replication?.ReplicateRemove(messageId);
             RaiseActivity("Discard", message?.Category ?? StoreAndForwardCategory.ExternalSystem,
                 $"Parked message {messageId} discarded");
         }