fix(high-severity): close 9 of 10 open High findings across 8 modules

Comm-016: delete dead HandleConnectionStateChanged + _debugSubscriptions /
_inProgressDeployments tracking + ConnectionStateChanged message record.
Disconnect detection is owned by the transport layers (gRPC keepalive PING
~25s; Ask-timeout at CommunicationService). Updates the
Component-Communication.md design doc to make that explicit.

SnF-018: NotificationForwarder.DeliverAsync now discards a corrupt buffered
payload (Warning log + return true) instead of returning false and parking
the row — honoring the design's "notifications do not park" invariant.

DM-018: reconciliation no longer force-sets Enabled, preserving an
intentional Disabled state after central failover.

ESG-018: DeliverBufferedAsync (both ExternalSystemClient + DatabaseGateway)
catches JsonException and returns false, turning a corrupt buffered row
into a parked operation instead of a retry-forever poison message.

InboundAPI-022: register ActiveNodeGate as IActiveNodeGate in the Central
DI branch so standby-node gating is actually wired up in production.

NS-019: remove orphaned NotificationDeliveryService /
INotificationDeliveryService / NotificationResult; central notification
delivery now lives entirely in NotificationOutbox.

SEL-016: normalise From/To filters to UTC before ISO-string compare so
non-UTC DateTimeOffset clients no longer get spuriously excluded events.

TE-017: include Description on attributes/alarms and a HashableConnections
projection (protocol, endpoint JSON, failover count) in the revision hash
and DiffService; staleness detection now catches description-only and
connection-endpoint edits.

Transport-001 and Transport-002 (also High) remain Open — they're being
handled in a follow-up batch because both touch BundleImporter.cs and
must serialise.

src/ScadaLink.ExternalSystemGateway/DatabaseGateway.cs

@@ -148,7 +148,26 @@ public class DatabaseGateway : IDatabaseGateway
     public async Task<bool> DeliverBufferedAsync(
         StoreAndForwardMessage message, CancellationToken cancellationToken = default)
     {
-        var payload = JsonSerializer.Deserialize<CachedWritePayload>(message.PayloadJson);
+        // ExternalSystemGateway-018: a malformed (not just empty/null-fielded)
+        // PayloadJson would otherwise throw `JsonException` here, which the S&F
+        // engine treats as a transient failure and retries forever (poison
+        // message). Re-running the same deserialization against the same payload
+        // will throw deterministically, so JsonException is permanent — log,
+        // and return false so the S&F engine parks the message instead.
+        CachedWritePayload? payload;
+        try
+        {
+            payload = JsonSerializer.Deserialize<CachedWritePayload>(message.PayloadJson);
+        }
+        catch (JsonException ex)
+        {
+            _logger.LogError(
+                ex,
+                "Buffered CachedDbWrite message {Id} has malformed JSON payload; parking.",
+                message.Id);
+            return false;
+        }
+
         if (payload == null || string.IsNullOrEmpty(payload.ConnectionName) || string.IsNullOrEmpty(payload.Sql))
         {
             _logger.LogError("Buffered CachedDbWrite message {Id} has an unreadable payload; parking.", message.Id);