perf(templates): resync and resolved-members read only the chain/subtree (ScadaBridge#89)

The last two whole-library template reads are gone. Both fed the
inheritance-only TemplateInheritanceResolver, which walks one template's
parent chain and never follows compositions.

- TemplateService.ResyncInheritedMembersAsync (operator repair, CLI + editor)
  now reads #86's GetTemplateReconcileClosureAsync (derived subtree + the
  template's chain, tracked). When nothing derives from the template the
  closure is empty, so it falls back to the new tracked
  GetTemplateChainAsync - resyncing a leaf reads only its own chain.
- ManagementActor.HandleGetResolvedTemplateMembers now reads
  GetTemplateChainAsync(id, trackChanges: false): the chain alone, untracked,
  with script bodies (the resolver projects script code, so #66's body-free
  analysis closure would not be equivalent).

The chain walk is factored out of TemplateReconcileClosure into
CollectChainAsync (one load per level, stops on parent cycles and dangling
parents) and shared by both.

Evidence:
- TemplateChainReadTests (#86 fixture): for every template plus an unknown
  id, the closure-backed resync issues exactly the writes, audit row and
  result of the whole-graph resync with GetAllTemplatesAsync wired to throw;
  the resolver answers identically from the chain and the whole graph.
  17 of these fail against the old service; 13 fail with the leaf chain
  fallback removed (mutation-checked).
- TemplateChainRepositoryTests (SQLite, recorded SQL): a 4-deep chain loads
  4 templates / 8 attributes instead of 46 / 92, one split-query set per
  level, untracked on request and tracked for the resync.
- ResolvedTemplateMembersReadTests: the actor answers from the untracked
  chain read and never calls GetAllTemplatesAsync (fails on the old actor).

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

tests/ZB.MOM.WW.ScadaBridge.TemplateEngine.Tests/AnalysisClosureMock.cs

@@ -42,7 +42,8 @@ internal static class AnalysisClosureMock
     /// Gitea #86: the descendant reconcile now asks for the reconcile closure (derived subtree +
     /// the template's chain) instead of <c>GetAllTemplatesAsync</c>. Wires it to run the real
     /// closure walk over whatever the full tracked-graph setup returns, so every existing
-    /// propagation scenario exercises the service against the reduced set.
+    /// propagation scenario exercises the service against the reduced set. Also serves the
+    /// chain-only read the inherited-member resync falls back to for a leaf (Gitea #89).
     /// </summary>
     /// <param name="repoMock">The repository mock.</param>
     /// <param name="closureRequests">Optional sink recording each requested closure root.</param>
@@ -65,5 +66,14 @@ internal static class AnalysisClosureMock
                     async (ids, token) => (await All(token)).Where(t => ids.Contains(t.Id)).ToList(),
                     ct);
             });
+
+        // Gitea #89: the resync of a template nobody derives from falls back to its chain.
+        repoMock
+            .Setup(r => r.GetTemplateChainAsync(It.IsAny<int>(), It.IsAny<bool>(), It.IsAny<CancellationToken>()))
+            .Returns((int templateId, bool _, CancellationToken ct) =>
+                TemplateReconcileClosure.CollectChainAsync(
+                    templateId,
+                    async (ids, token) => (await All(token)).Where(t => ids.Contains(t.Id)).ToList(),
+                    ct));
     }
 }