fix(configuration-database): resolve ConfigurationDatabase-002..007 — remove hardcoded sa creds, fail-fast no-arg DI, encrypt secret columns, resilient audit serialization

src/ScadaLink.ConfigurationDatabase/Configurations/ExternalSystemConfiguration.cs

@@ -22,8 +22,10 @@ public class ExternalSystemDefinitionConfiguration : IEntityTypeConfiguration<Ex
             .IsRequired()
             .HasMaxLength(50);
 
+        // Stored encrypted at rest (EncryptedStringConverter). Ciphertext is larger than
+        // the plaintext, so the column is sized generously to avoid truncation.
         builder.Property(e => e.AuthConfiguration)
-            .HasMaxLength(4000);
+            .HasMaxLength(8000);
 
         builder.HasMany<ExternalSystemMethod>()
             .WithOne()
@@ -72,9 +74,11 @@ public class DatabaseConnectionDefinitionConfiguration : IEntityTypeConfiguratio
             .IsRequired()
             .HasMaxLength(200);
 
+        // Stored encrypted at rest (EncryptedStringConverter). Ciphertext is larger than
+        // the plaintext, so the column is sized generously to avoid truncation.
         builder.Property(d => d.ConnectionString)
             .IsRequired()
-            .HasMaxLength(4000);
+            .HasMaxLength(8000);
 
         builder.HasIndex(d => d.Name).IsUnique();
     }

src/ScadaLink.ConfigurationDatabase/Configurations/NotificationConfiguration.cs

@@ -53,8 +53,10 @@ public class SmtpConfigurationConfiguration : IEntityTypeConfiguration<SmtpConfi
             .IsRequired()
             .HasMaxLength(50);
 
+        // Stored encrypted at rest (EncryptedStringConverter). Ciphertext is larger than
+        // the plaintext, so the column is sized generously to avoid truncation.
         builder.Property(s => s.Credentials)
-            .HasMaxLength(4000);
+            .HasMaxLength(8000);
 
         builder.Property(s => s.TlsMode)
             .HasMaxLength(50);