feat(transport): fleet-wide bundle-unlock throttle window (register row 52)

The per-IP unlock throttle's counters were a process-local ConcurrentDictionary
on each central node, so the effective fleet cap was N x
MaxUnlockAttemptsPerIpPerHour per client (failing over to the other node handed
the client a fresh budget) and a node restart cleared the window outright.

The window now lives in the central MS SQL BundleUnlockAttempt table — the HA
store both central nodes already share, so no new infrastructure, no new port,
no consensus protocol:

- Commons: BundleUnlockAttempt entity + IBundleUnlockAttemptRepository.
- ConfigurationDatabase: entity config (one index,
  IX_BundleUnlockAttempt_Client_Attempted, serving both the windowed count and
  the prune), repository (AsNoTracking count, ExecuteDeleteAsync prune),
  DbSet, DI registration, migration AddBundleUnlockAttemptTable + the
  hand-written idempotent production script under docs/plans/sql/.
- Transport: IBundleUnlockAttemptWindow seam + SqlBundleUnlockAttemptWindow
  (singleton; resolves the scoped repository from its own scope per call, like
  the central purge singletons). BundleUnlockRateLimiter keeps the policy and
  gains TryRegisterAttemptAsync; BundleImporter.LoadAsync calls it.

Behaviour preserved from row 44: locked bundles spend no hourly budget (the
lockout check still runs first), throttle denials burn no per-bundle strike and
are NOT recorded so they cannot roll the window forward, unattributable clients
share the stricter <unattributed> bucket, and the budget counts attempts rather
than failures. Config keys and their semantics are unchanged, so the rig's 500
override stays valid.

Three deliberate trades, documented in both Transport docs:
- FAILS OPEN. A store error logs a Warning naming the client and cap, and
  permits the attempt. This is a best-effort rate cap over an already
  authenticated, Administrator-gated surface — the availability of legitimate
  imports outranks the cap, and a DB blip must not make the import wizard
  unusable. Falling back to the process-local window was considered and
  rejected: it would still block a legitimate operator's 11th import.
- Approximate. Count-then-insert is not atomic across nodes, so simultaneous
  attempts can overshoot by the number in flight — bounded, self-correcting
  within the window, and not worth provider-specific raw SQL.
- Pruned opportunistically on the unlock path (CAS-claimed at most every 15
  min per process, bounded to 1000 rows, retaining 2x the window, best-effort
  try/catch) rather than by a new background service — Transport owns no
  central scheduler. Same shape as DeploymentService's terminal-record sweep.

Tests: Transport.IntegrationTests 116 passed (+10 — two limiter instances over
one store enforcing a single combined window, restart durability, denials
burning no budget, sliding release, bucket isolation, store-failure fail-open,
caller-cancellation not swallowed, no-shared-window fallback, prune and its
negative control); ConfigurationDatabase 395 passed (+5).

src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/Repositories/BundleUnlockAttemptRepository.cs

@@ -0,0 +1,70 @@
+using Microsoft.EntityFrameworkCore;
+using ZB.MOM.WW.ScadaBridge.Commons.Entities.Transport;
+using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Repositories;
+
+namespace ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Repositories;
+
+/// <summary>
+/// EF Core implementation of <see cref="IBundleUnlockAttemptRepository"/> over the central
+/// <c>BundleUnlockAttempt</c> table (register row 52). Plain reads/writes against the
+/// shared <see cref="ScadaBridgeDbContext"/>; the prune uses <c>ExecuteDeleteAsync</c> so
+/// no rows are materialised into the change tracker.
+/// </summary>
+public class BundleUnlockAttemptRepository : IBundleUnlockAttemptRepository
+{
+    private readonly ScadaBridgeDbContext _context;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="BundleUnlockAttemptRepository"/> class.
+    /// </summary>
+    /// <param name="context">The EF Core database context.</param>
+    public BundleUnlockAttemptRepository(ScadaBridgeDbContext context)
+    {
+        _context = context ?? throw new ArgumentNullException(nameof(context));
+    }
+
+    /// <inheritdoc />
+    public async Task<int> CountAttemptsSinceAsync(
+        string clientKey, DateTime sinceUtc, CancellationToken ct = default)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(clientKey);
+
+        return await _context.BundleUnlockAttempts
+            .AsNoTracking()
+            .Where(a => a.ClientKey == clientKey && a.AttemptedAtUtc >= sinceUtc)
+            .CountAsync(ct);
+    }
+
+    /// <inheritdoc />
+    public async Task RecordAttemptAsync(
+        string clientKey, DateTime attemptedAtUtc, CancellationToken ct = default)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(clientKey);
+
+        _context.BundleUnlockAttempts.Add(new BundleUnlockAttempt
+        {
+            ClientKey = clientKey,
+            AttemptedAtUtc = attemptedAtUtc,
+        });
+        await _context.SaveChangesAsync(ct);
+    }
+
+    /// <inheritdoc />
+    public async Task<int> PruneAttemptsOlderThanAsync(
+        DateTime beforeUtc, int maxRows, CancellationToken ct = default)
+    {
+        if (maxRows < 1)
+        {
+            throw new ArgumentOutOfRangeException(nameof(maxRows), "Prune batch size must be at least 1.");
+        }
+
+        // Bounded by construction: OrderBy + Take caps the delete regardless of how much
+        // history accumulated while the prune was failing or the node was down, so an
+        // opportunistic sweep on a request path can never become an unbounded delete.
+        return await _context.BundleUnlockAttempts
+            .Where(a => a.AttemptedAtUtc < beforeUtc)
+            .OrderBy(a => a.AttemptedAtUtc)
+            .Take(maxRows)
+            .ExecuteDeleteAsync(ct);
+    }
+}