fix(options): bind + validate OperationTrackingOptions; register the site IOperationTrackingStore that two comments claimed AddSiteRuntime provides (plan R2-08 T8, arch-review 08r2 NF4)

VERIFY-THEN-FIX: the plan-authoring discovery is CONFIRMED. No code anywhere in
src/ registered IOperationTrackingStore in DI, yet AkkaHostedService and
AuditLog SCE both comment that AddSiteRuntime provides it. Every consumer
resolved it via GetService (null-tolerant) and silently ran degraded:
cached-drain scheduler never armed, PullSiteCalls reconciliation seam never
wired, Tracking.Status degraded to audit-only. This is a FUNCTIONAL FIX riding
the hygiene plan: AddSiteRuntime now registers the store (site-only), so
site-local cached-call tracking runs in its intended mode. OperationTrackingOptions
is now bound + eagerly validated in the Host site-options block.

tests/ZB.MOM.WW.ScadaBridge.Host.Tests/CompositionRootTests.cs

@@ -339,10 +339,12 @@ public class SiteCompositionRootTests : IDisposable
 {
     private readonly WebApplication _host;
     private readonly string _tempDbPath;
+    private readonly string _tempTrackingDbPath;
 
     public SiteCompositionRootTests()
     {
         _tempDbPath = Path.Combine(Path.GetTempPath(), $"scadabridge_test_{Guid.NewGuid()}.db");
+        _tempTrackingDbPath = Path.Combine(Path.GetTempPath(), $"scadabridge_track_{Guid.NewGuid()}.db");
 
         var builder = WebApplication.CreateBuilder();
         builder.Configuration.Sources.Clear();
@@ -355,6 +357,10 @@ public class SiteCompositionRootTests : IDisposable
             ["ScadaBridge:Node:RemotingPort"] = "0",
             ["ScadaBridge:Node:GrpcPort"] = "0",
             ["ScadaBridge:Database:SiteDbPath"] = _tempDbPath,
+            // Point the site-local operation-tracking SQLite store (the ctor opens/creates
+            // the file eagerly) at a temp path so resolving IOperationTrackingStore in the
+            // composition-root test does not litter site-tracking.db in the test cwd.
+            ["ScadaBridge:OperationTracking:ConnectionString"] = $"Data Source={_tempTrackingDbPath}",
             // ClusterOptions requires at least one seed node (ClusterOptionsValidator).
             ["ScadaBridge:Cluster:SeedNodes:0"] = "akka.tcp://scadabridge@localhost:2551",
             ["ScadaBridge:Cluster:SeedNodes:1"] = "akka.tcp://scadabridge@localhost:2552",
@@ -377,6 +383,20 @@ public class SiteCompositionRootTests : IDisposable
     {
         (_host as IDisposable)?.Dispose();
         try { File.Delete(_tempDbPath); } catch { /* best effort */ }
+        try { File.Delete(_tempTrackingDbPath); } catch { /* best effort */ }
+    }
+
+    [Fact]
+    public void Site_Resolves_IOperationTrackingStore()
+    {
+        // Site Call Audit's site-local source of truth. AkkaHostedService and
+        // ScriptRuntimeContext resolve this with GetService and silently degrade
+        // when absent (audit-only telemetry, no cached-drain, no PullSiteCalls) —
+        // so its presence on the SITE composition root must be locked here
+        // (arch-review 08 round 2 NF4/T8: AddSiteRuntime never registered it,
+        // despite two comments claiming it did).
+        var store = _host.Services.GetService<ZB.MOM.WW.ScadaBridge.Commons.Interfaces.IOperationTrackingStore>();
+        Assert.NotNull(store);
     }
 
     // --- Singletons ---

tests/ZB.MOM.WW.ScadaBridge.SiteRuntime.Tests/Tracking/OperationTrackingOptionsValidatorTests.cs

@@ -0,0 +1,40 @@
+using ZB.MOM.WW.ScadaBridge.SiteRuntime.Tracking;
+
+namespace ZB.MOM.WW.ScadaBridge.SiteRuntime.Tests.Tracking;
+
+/// <summary>
+/// Eager startup validation for <see cref="OperationTrackingOptions"/>
+/// (arch-review 08 round 2 NF4). The store opens the SQLite connection string at
+/// construction, so an empty connection string must fail the host at boot; the
+/// retention window must be positive or terminal-row purge would delete
+/// everything.
+/// </summary>
+public class OperationTrackingOptionsValidatorTests
+{
+    [Fact]
+    public void DefaultOptions_AreValid()
+    {
+        var validator = new OperationTrackingOptionsValidator();
+        Assert.True(validator.Validate(null, new OperationTrackingOptions()).Succeeded);
+    }
+
+    [Fact]
+    public void EmptyConnectionString_Fails()
+    {
+        var validator = new OperationTrackingOptionsValidator();
+        var result = validator.Validate(null, new OperationTrackingOptions { ConnectionString = "" });
+        Assert.False(result.Succeeded);
+        Assert.Contains(result.Failures!,
+            f => f.Contains(nameof(OperationTrackingOptions.ConnectionString), StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void ZeroRetentionDays_Fails()
+    {
+        var validator = new OperationTrackingOptionsValidator();
+        var result = validator.Validate(null, new OperationTrackingOptions { RetentionDays = 0 });
+        Assert.False(result.Succeeded);
+        Assert.Contains(result.Failures!,
+            f => f.Contains(nameof(OperationTrackingOptions.RetentionDays), StringComparison.Ordinal));
+    }
+}