feat(health): KPI history + sustained-backlog badge for LocalDb replication (row 33)

LocalDbOplogBacklog was reported and Prometheus-exported with nothing consuming
it: not sampled into KPI history, so a purge-burst spike could not be reviewed
after the fact, and no threshold treatment anywhere. Both halves shipped.

KPI SAMPLING. SiteHealthKpiSampleSource now emits localDbOplogBacklog and
localDbReplicationConnected (0/1), and the backlog is charted on the Health
dashboard's per-site trend panel. Charting is the point: a point-in-time tile
can never answer 'did that spike drain?', which is the only thing separating an
expected purge burst from a stalled peer.

Both are CONDITIONALLY emitted rather than coerced with ?? 0 like the
auditBacklogPending metric beside them. Both health-report fields are nullable
and null means 'no reading' — replication not configured (rig site-b/site-c) or
a failed poll — never zero. A fabricated 0 would render a pair that cannot read
its own oplog, or one deliberately unreplicated, as perfectly healthy once a
minute forever, burying the real series. So a site emits 12 metrics when
unreplicated and 14 when replicated, and a GAP in these two series truthfully
means 'not replicated / not reporting'. Note false and null differ for the
connected flag: a configured link that is DOWN samples as 0; no link samples as
nothing. Both fold as Gauge (summing an oplog depth, or a 0/1 flag, per hour is
meaningless).

THRESHOLD SEMANTICS — sustained, not instantaneous. This is the design, not a
refinement. The site_events retention purge is CDC-captured like any other
write, so the backlog jumps by the deleted batch and drains as the peer acks
it; a bare 'backlog > threshold' badge would fire on every replicated site
every day and be ignored within a week. Healthy is defined by the backlog
RETURNING to ~0, which only a dwell can express. CentralHealthAggregator holds
LocalDbBacklogAboveSince — the instant the backlog first rose above
LocalDbBacklogThreshold (default 1000) — and the badge appears only after
LocalDbBacklogSustainedFor (default 15 min). A report at or below the threshold
clears the anchor; one above leaves the ORIGINAL instant intact, so the window
is sustained rather than sliding.

The null case is deliberately a third branch: a null backlog leaves the anchor
UNCHANGED rather than clearing it. Null is evidence neither of a drain nor of a
backlog, so a node going blind mid-climb must not silently reset its own dwell,
and an unreplicated site (null forever) never accumulates an anchor and can
never be badged.

Validation rejects a non-positive threshold (0 would badge every replicated site
permanently, since an idle backlog already sits at it) and a dwell shorter than
one ReportInterval (satisfiable by a single sample, which collapses the check
back into the bare threshold it replaces).

DOC CORRECTION worth flagging: this row's premise was 'mirror the SiteAuditBacklog
configurable threshold badge'. That badge does not exist — Component-HealthMonitoring.md
described it in two places but no option, no comparison and no markup were ever
implemented. The two stale claims are corrected here rather than left to send the
next reader looking for it; the LocalDb badge is built fresh on the Metrics-stale
badge's pattern, which is a real configurable-threshold badge.

Tests: HealthMonitoring 115 (9 new aggregator tests incl. purge-burst-drains,
unreplicated-never-anchors, null-mid-climb, exact-threshold, stale-report; 5 new
validator tests; 4 new sampler tests incl. the null-semantics and false-vs-null
cases); CentralUI 1042 (5 new badge/chart tests incl. the purge-burst negative
control); Commons Kpi 93; KpiHistory 54.

src/ZB.MOM.WW.ScadaBridge.HealthMonitoring/CentralHealthAggregator.cs

@@ -50,7 +50,8 @@ public class CentralHealthAggregator : BackgroundService, ICentralHealthAggregat
                     FirstSeenAt = now,
                     LastSequenceNumber = report.SequenceNumber,
                     IsOnline = true,
-                    IsMetricsStale = false
+                    IsMetricsStale = false,
+                    LocalDbBacklogAboveSince = NextBacklogAboveSince(null, report, now)
                     // LastStatusChangeAt stays null: first observation is not a flip.
                 };
 
@@ -84,7 +85,9 @@ public class CentralHealthAggregator : BackgroundService, ICentralHealthAggregat
                 IsMetricsStale = false,
                 // Stamp a flip only when this report brings the site back online;
                 // a report from an already-online site leaves the timestamp be.
-                LastStatusChangeAt = existing.IsOnline ? existing.LastStatusChangeAt : now
+                LastStatusChangeAt = existing.IsOnline ? existing.LastStatusChangeAt : now,
+                LocalDbBacklogAboveSince =
+                    NextBacklogAboveSince(existing.LocalDbBacklogAboveSince, report, now)
             };
 
             if (_siteStates.TryUpdate(report.SiteId, updated, existing))
@@ -320,4 +323,43 @@ public class CentralHealthAggregator : BackgroundService, ICentralHealthAggregat
             }
         }
     }
+
+    /// <summary>
+    /// Advances the sustained-backlog anchor for one incoming report (register row 33).
+    /// </summary>
+    /// <remarks>
+    /// Three cases, and the null one is the subtle one:
+    /// <list type="bullet">
+    /// <item><description>
+    /// Backlog <c>null</c> — no reading. An unreplicated site (rig site-b/site-c) reports this
+    /// forever, and a replicated site reports it when a poll fails. Carry the previous anchor
+    /// through UNCHANGED: null is not zero, so it is neither evidence of a drain (which would
+    /// justify clearing) nor of a backlog (which would justify starting one). An unreplicated
+    /// site therefore never accumulates an anchor and can never be badged.
+    /// </description></item>
+    /// <item><description>
+    /// Backlog above the threshold — start the clock if it is not already running. Keeping the
+    /// ORIGINAL start instant is what makes the window sustained rather than sliding.
+    /// </description></item>
+    /// <item><description>
+    /// Backlog at or below the threshold — clear. This is the daily purge burst's exit path:
+    /// the spike drains within a few reports and the anchor is discarded long before the dwell
+    /// elapses, so the expected burst never badges the site.
+    /// </description></item>
+    /// </list>
+    /// </remarks>
+    /// <param name="current">The anchor currently held for this site, if any.</param>
+    /// <param name="report">The incoming health report.</param>
+    /// <param name="now">The current time.</param>
+    /// <returns>The anchor to store.</returns>
+    private DateTimeOffset? NextBacklogAboveSince(
+        DateTimeOffset? current, SiteHealthReport report, DateTimeOffset now)
+    {
+        if (report.LocalDbOplogBacklog is not { } backlog)
+        {
+            return current;
+        }
+
+        return backlog > _options.LocalDbBacklogThreshold ? current ?? now : null;
+    }
 }