chore(config): retire ReplicationEnabled, make legacy db paths migration-only

LocalDb Phase 2 deleted the bespoke replicators, so three config keys changed
meaning or died outright:

- ScadaBridge:StoreAndForward:ReplicationEnabled is fully dead. Deleted the
  property, its 10 config entries, and the 5 test references.
- SqliteDbPath / SiteDbPath are now migration-only: they name the legacy files
  SiteLocalDbLegacyMigrator drains at boot, not live databases. Both mandatory
  rules are relaxed accordingly (StartupValidator's Site-only Require, and the
  S&F validator's non-empty rule) — an absent value now means "nothing to
  migrate", so an already-migrated node can drop the key. DatabaseOptions-
  Validator still rejects a present-but-blank value.
- SiteRuntime:ConfigFetchRetryCount's only reader was SiteReplicationActor.
  Deleted with its validator rule.

The two path keys stay present in every config, now with a comment explaining
why: removing them would strand un-migrated data on a node that has not yet
started once.

Both relaxations are pinned by the inverse of the test they replace
(Site_MissingSiteDbPath_IsAccepted..., EmptySqliteDbPath_IsAccepted...), each
verified to fail with the old rule restored.

Note: deploy/wonder-app-vd03/appsettings.Site.json is under a gitignored
deploy/ tree, so its edit is local-only and must be repeated on the box.

Claude-Session: https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts

src/ZB.MOM.WW.ScadaBridge.Host/StartupValidator.cs

@@ -94,7 +94,7 @@ public static class StartupValidator
                 _ => seedNodes != null && seedNodes.Count >= 2,
                 "must have at least 2 entries")
             // The big Site-only block: GrpcPort/MetricsPort validity + cross-field
-            // collisions + SiteDbPath + seed-node-port loop, in the original order.
+            // collisions + seed-node-port loop, in the original order.
             .When(role == "Site", p =>
             {
                 // GrpcPort range, then GrpcPort vs RemotingPort.
@@ -110,9 +110,12 @@ public static class StartupValidator
                 p.Require("ScadaBridge:Node:MetricsPort", _ => metricsPort != port, "must differ from RemotingPort");
                 p.Require("ScadaBridge:Node:MetricsPort", _ => metricsPort != grpcPort, "must differ from GrpcPort");
 
-                p.Require("ScadaBridge:Database:SiteDbPath",
-                    _ => !string.IsNullOrEmpty(configuration.GetSection("ScadaBridge:Database")["SiteDbPath"]),
-                    "required for Site nodes");
+                // ScadaBridge:Database:SiteDbPath was required here until LocalDb
+                // Phase 2. The site's tables now live in the consolidated LocalDb
+                // database (LocalDb:Path, which SiteServiceRegistration requires),
+                // and SiteDbPath survives only as the legacy migration source — so
+                // its absence means "nothing to migrate", not a misconfiguration.
+                // DatabaseOptionsValidator still rejects a present-but-blank value.
 
                 // A seed node must reference an Akka.Remote endpoint, never the
                 // Kestrel HTTP/2 gRPC port. A seed entry whose port equals this node's

src/ZB.MOM.WW.ScadaBridge.Host/appsettings.Site.json

@@ -23,6 +23,10 @@
       "MinNrOfMembers": 1
     },
     "Database": {
+      // Migration-only as of LocalDb Phase 2. The site config tables now live in the
+      // consolidated LocalDb database (LocalDb:Path). SiteDbPath is read once at boot to drain
+      // a pre-Phase-2 scadabridge.db, and is unused after that - keep it until this node has
+      // started once.
       "SiteDbPath": "./data/scadabridge.db"
     },
     "DataConnection": {
@@ -31,8 +35,11 @@
       "WriteTimeout": "00:00:30"
     },
     "StoreAndForward": {
-      "SqliteDbPath": "./data/store-and-forward.db",
-      "ReplicationEnabled": true
+      // Migration-only as of LocalDb Phase 2. The store-and-forward buffer now lives in the
+      // consolidated LocalDb database (LocalDb:Path) as the replicated sf_messages table.
+      // SqliteDbPath is read once at boot by SiteLocalDbLegacyMigrator to drain a pre-Phase-2
+      // file, and is unused after that - keep it until this node has started once.
+      "SqliteDbPath": "./data/store-and-forward.db"
     },
     "Communication": {
       "_centralContactPoints": "Host-016: each entry MUST be a central node's remoting endpoint, NOT this site's own remoting port. The single dev-loopback default below points only at central-a (localhost:8081). In a multi-central deployment add the second central node here (e.g. 'akka.tcp://scadabridge@central-b-host:8081') so ClusterClient can fail over when central-a is down. The previous template listed localhost:8082 as the second contact — that is THIS site's own RemotingPort and is a permanent failure in the initial-contact rotation.",

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/SiteRuntimeOptions.cs

@@ -60,13 +60,6 @@ public class SiteRuntimeOptions
     /// <summary>HTTP timeout (seconds) for fetching a deployment config from central (notify-and-fetch).</summary>
     public int ConfigFetchTimeoutSeconds { get; set; } = 30;
 
-    /// <summary>
-    /// Bounded attempt count (including the first) for the standby's replicated-config
-    /// fetch; a 2 s fixed delay separates attempts and superseded fetches never retry.
-    /// Consumed by <c>SiteReplicationActor.HandleApplyConfigDeploy</c> (UA2). Default: 3.
-    /// </summary>
-    public int ConfigFetchRetryCount { get; set; } = 3;
-
     /// <summary>
     /// Fixed interval (ms) at which an Instance Actor re-sends a tag-subscribe
     /// request that either failed or whose response was lost (S4/UA6). The retry is

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/SiteRuntimeOptionsValidator.cs

@@ -53,10 +53,6 @@ public sealed class SiteRuntimeOptionsValidator : OptionsValidatorBase<SiteRunti
             $"ScadaBridge:SiteRuntime:ConfigFetchTimeoutSeconds must be greater than 0 " +
             $"(was {options.ConfigFetchTimeoutSeconds}).");
 
-        builder.RequireThat(options.ConfigFetchRetryCount >= 0,
-            $"ScadaBridge:SiteRuntime:ConfigFetchRetryCount must be >= 0 " +
-            $"(was {options.ConfigFetchRetryCount}).");
-
         builder.RequireThat(options.TagSubscribeRetryIntervalMs > 0,
             $"ScadaBridge:SiteRuntime:TagSubscribeRetryIntervalMs must be greater than 0 " +
             $"(was {options.TagSubscribeRetryIntervalMs}); a zero interval hot-loops the tag-subscribe " +

src/ZB.MOM.WW.ScadaBridge.StoreAndForward/StoreAndForwardOptions.cs

@@ -5,12 +5,15 @@ namespace ZB.MOM.WW.ScadaBridge.StoreAndForward;
 /// </summary>
 public class StoreAndForwardOptions
 {
-    /// <summary>Path to the SQLite database for S&amp;F message persistence.</summary>
+    /// <summary>
+    /// Path to the legacy standalone store-and-forward SQLite file. <b>Migration-only.</b>
+    /// The buffer itself lives in the consolidated LocalDb database (<c>LocalDb:Path</c>)
+    /// as of LocalDb Phase 2; this path is read once at boot by
+    /// <c>SiteLocalDbLegacyMigrator</c> to drain a pre-Phase-2 file, and is otherwise
+    /// unused. A node that has already migrated may leave it set or unset.
+    /// </summary>
     public string SqliteDbPath { get; set; } = "./data/store-and-forward.db";
 
-    /// <summary>Whether to replicate buffer operations to standby node.</summary>
-    public bool ReplicationEnabled { get; set; } = true;
-
     /// <summary>Default retry interval for messages without per-source settings.</summary>
     public TimeSpan DefaultRetryInterval { get; set; } = TimeSpan.FromSeconds(30);
 

src/ZB.MOM.WW.ScadaBridge.StoreAndForward/StoreAndForwardOptionsValidator.cs

@@ -5,21 +5,23 @@ namespace ZB.MOM.WW.ScadaBridge.StoreAndForward;
 /// <summary>
 /// Validates <see cref="StoreAndForwardOptions"/> at startup. The retry intervals
 /// feed the background sweep timer (a zero/negative period trips
-/// <see cref="ArgumentOutOfRangeException"/> in the timer constructor) and the
-/// SQLite path is opened for the S&amp;F buffer; an empty path yields an opaque
-/// connection failure at first enqueue. Registered with <c>ValidateOnStart()</c>
-/// so a bad <c>ScadaBridge:StoreAndForward</c> section fails fast at boot with a
-/// clear, key-naming message.
+/// <see cref="ArgumentOutOfRangeException"/> in the timer constructor). Registered
+/// with <c>ValidateOnStart()</c> so a bad <c>ScadaBridge:StoreAndForward</c> section
+/// fails fast at boot with a clear, key-naming message.
+/// <para>
+/// <see cref="StoreAndForwardOptions.SqliteDbPath"/> is deliberately NOT validated.
+/// Before LocalDb Phase 2 it was the live buffer file, so an empty value produced an
+/// opaque connection failure at first enqueue; the buffer now lives in the
+/// consolidated LocalDb database and the key survives only as the legacy migration
+/// source. An empty value there is a legitimate "nothing to migrate", so requiring
+/// it would make every already-migrated node carry a dead key forever.
+/// </para>
 /// </summary>
 public sealed class StoreAndForwardOptionsValidator : OptionsValidatorBase<StoreAndForwardOptions>
 {
     /// <inheritdoc />
     protected override void Validate(ValidationBuilder builder, StoreAndForwardOptions options)
     {
-        builder.RequireThat(!string.IsNullOrWhiteSpace(options.SqliteDbPath),
-            "ScadaBridge:StoreAndForward:SqliteDbPath must be a non-empty path; " +
-            "it is the SQLite file backing the store-and-forward buffer.");
-
         builder.RequireThat(options.DefaultRetryInterval > TimeSpan.Zero,
             $"ScadaBridge:StoreAndForward:DefaultRetryInterval must be a positive duration " +
             $"(was {options.DefaultRetryInterval}); it is the default per-message retry interval.");