feat(management): server-side secured-write TTL — stale pending writes expire, never execute (arch-review S2)

Claude-Session: https://claude.ai/code/session_01MtdgwpEeCUn6cUA5f1LMPj

src/ZB.MOM.WW.ScadaBridge.ManagementService/ManagementServiceOptions.cs

@@ -7,4 +7,7 @@ public class ManagementServiceOptions
 
     /// <summary>Maximum time to wait for a long-running transport/deploy command (import/preview/export bundle, deploy artifacts/instance) before returning a timeout error; default 5 minutes.</summary>
     public TimeSpan LongRunningCommandTimeout { get; set; } = TimeSpan.FromMinutes(5);
+
+    /// <summary>Age after which a Pending secured write can no longer be approved; it is transitioned to Expired at the next decision/list touch. Default 24 hours. A non-positive value disables server-side expiry.</summary>
+    public TimeSpan SecuredWritePendingTtl { get; set; } = TimeSpan.FromHours(24);
 }