fix(template-engine): resolve TemplateEngine-006..010 — code-region-aware API/brace scanning, composed-alarm override validation, N+1 fix, doc correction

src/ScadaLink.TemplateEngine/Validation/ValidationService.cs

@@ -317,9 +317,12 @@ public class ValidationService
     /// </summary>
     internal static string? CheckExpressionSyntax(string expression)
     {
+        // Advisory forbidden-API scan (TemplateEngine-006): code-region-aware so
+        // the inert text inside a string/comment is not flagged, but still a
+        // substring match — not an authoritative boundary. See ScriptCompiler.
         foreach (var pattern in ScriptCompiler.ForbiddenPatterns)
         {
-            if (expression.Contains(pattern, StringComparison.Ordinal))
+            if (CSharpDelimiterScanner.ContainsInCode(expression, pattern))
             {
                 return $"uses forbidden API '{pattern.TrimEnd('.')}'. " +
                        "Trigger expressions cannot use System.IO, Process, Threading, Reflection, or raw network APIs.";