refactor: rename ScadaLink → ZB.MOM.WW.ScadaBridge (code + projects + namespaces)

Solution + 23 src projects + 26 test projects renamed; folders, csproj,
namespaces, and ScadaLinkDbContext/ScadaBridgeDbContext class updated.
ActorSystem "scadalink" → "scadabridge", Akka seed-node URLs migrated.
SQL roles/logins, LDAP domains, CLI command name, and CLI config dir
(~/.scadalink → ~/.scadabridge) also renamed.

Build green; 5 Host.Tests fail awaiting SQL login rename in next commit.
Pre-existing StaleTagMonitor timing flakes unchanged.

Rename script committed at tools/rename-to-scadabridge.sh.

src/ZB.MOM.WW.ScadaBridge.InboundAPI/InboundApiOptions.cs

@@ -0,0 +1,35 @@
+namespace ZB.MOM.WW.ScadaBridge.InboundAPI;
+
+public class InboundApiOptions
+{
+    /// <summary>
+    /// Default cap on the inbound API request body, in bytes (InboundAPI-006).
+    /// </summary>
+    public const long DefaultMaxRequestBodyBytes = 1L * 1024 * 1024; // 1 MiB
+
+    /// <summary>Default timeout for inbound API method execution before the request is cancelled.</summary>
+    public TimeSpan DefaultMethodTimeout { get; set; } = TimeSpan.FromSeconds(30);
+
+    /// <summary>
+    /// InboundAPI-006: maximum accepted request body size for <c>POST /api/{methodName}</c>.
+    /// Requests whose body exceeds this are rejected with HTTP 413 before being
+    /// buffered into a <see cref="System.Text.Json.JsonDocument"/>. The inbound API
+    /// has no rate limiting (a deliberate design choice), so an explicit, modest cap
+    /// bounds per-request allocations.
+    /// </summary>
+    public long MaxRequestBodyBytes { get; set; } = DefaultMaxRequestBodyBytes;
+
+    /// <summary>
+    /// ConfigurationDatabase-012: server-side HMAC pepper used to hash inbound-API
+    /// bearer credentials. API keys are persisted as a deterministic keyed hash, never
+    /// as plaintext; this pepper is the HMAC key that binds every hash to this
+    /// deployment, so a stolen configuration database is not directly exploitable.
+    /// <para>
+    /// This is a secret: supply a strong, random value via configuration or a secret
+    /// store, never hard-coded. It must be present and at least
+    /// <see cref="ZB.MOM.WW.ScadaBridge.Commons.Types.InboundApi.ApiKeyHasher.MinimumPepperLength"/>
+    /// characters — <c>AddInboundAPI</c> fails fast otherwise.
+    /// </para>
+    /// </summary>
+    public string ApiKeyPepper { get; set; } = string.Empty;
+}