fix(transport): curate BundleLockedException on the management surface (register row 51)

ManagementService references Commons but not Transport, so MapFault could not
see BundleLockedException and the per-bundle 3-strike lockout reached the CLI
as "An internal error occurred (CorrelationId=...)" — the operator got a
correlation id instead of the reason, and no hint that further attempts on
that bundle would be refused.

Applies the pattern register row 44 established for BundleUnlockThrottledException:

- Relocate BundleLockedException from Transport/Import/ to
  Commons/Types/Transport/, beside BundleUnlockThrottledException. Both
  consumers (BundleImporter, CentralUI TransportImport) already carried the
  Commons.Types.Transport using, so no call-site edits were needed.
- Add curated catch arms in ManagementActor.HandlePreviewBundle and
  HandleImportBundle that rethrow as ManagementCommandException, so the
  message survives MapFault's disclosure filter.
- Mirror the row-44 throttle fault-mapping test for both handlers.
- Document the relocation in docs/components/Transport.md and
  docs/requirements/Component-Transport.md.

Tests: ManagementService 499 passed (+2 new), Transport 167 passed.

src/ZB.MOM.WW.ScadaBridge.Commons/Types/Transport/BundleLockedException.cs

@@ -0,0 +1,44 @@
+namespace ZB.MOM.WW.ScadaBridge.Commons.Types.Transport;
+
+/// <summary>
+/// T-003: thrown by <c>IBundleImporter.LoadAsync</c> when an encrypted bundle has
+/// exceeded the configured failed-unlock attempt limit
+/// (<c>TransportOptions.MaxUnlockAttemptsPerSession</c>, default 3). The lockout is tracked
+/// server-side keyed by <see cref="BundleManifest.ContentHash"/>, so a second tab / CLI caller
+/// re-uploading the same bytes hits the same counter and cannot side-step the limit.
+/// <para>
+/// Distinct from <see cref="BundleUnlockThrottledException"/> on purpose: this one means
+/// "this BUNDLE has burned its strikes" and is keyed by the bundle's content hash; that one
+/// means "this CLIENT has attempted too many unlocks, across any bundles" and is keyed by
+/// the caller's IP.
+/// </para>
+/// <para>
+/// Register row 51: lives in Commons rather than beside the importer for the same reason
+/// <see cref="BundleUnlockThrottledException"/> does — it is part of the
+/// <c>IBundleImporter.LoadAsync</c> contract, which is declared here, and the management
+/// surface (which references Commons but not Transport) must be able to catch it to return
+/// a clear, curated error instead of a generic internal-failure message plus a correlation id.
+/// </para>
+/// </summary>
+public sealed class BundleLockedException : Exception
+{
+    /// <summary>Number of recorded unlock failures for this bundle.</summary>
+    public int FailedAttempts { get; }
+
+    /// <summary>SHA-256 (hex) of the bundle's content bytes, the lockout's tracking key.</summary>
+    public string BundleContentHash { get; }
+
+    /// <summary>
+    /// Initializes a new <see cref="BundleLockedException"/>.
+    /// </summary>
+    /// <param name="bundleContentHash">SHA-256 hex from <see cref="BundleManifest.ContentHash"/>.</param>
+    /// <param name="failedAttempts">Number of failures recorded against this bundle.</param>
+    public BundleLockedException(string bundleContentHash, int failedAttempts)
+        : base(
+            $"Bundle is locked after {failedAttempts} failed unlock attempts. "
+            + "Wait for the lockout window to expire or re-export the bundle to obtain a new content hash.")
+    {
+        BundleContentHash = bundleContentHash ?? throw new ArgumentNullException(nameof(bundleContentHash));
+        FailedAttempts = failedAttempts;
+    }
+}

src/ZB.MOM.WW.ScadaBridge.ManagementService/ManagementActor.cs

@@ -3567,6 +3567,17 @@ public class ManagementActor : ReceiveActor
             {
                 throw new ManagementCommandException(ex.Message);
             }
+            catch (BundleLockedException ex)
+            {
+                // Register row 51: the per-bundle 3-strike lockout. LoadAsync raises
+                // it from inside its own CryptographicException handler, so without
+                // this arm the operator saw MapFault's generic internal-error message
+                // plus a correlation id, never the reason. Listed ahead of the
+                // CryptographicException arm to keep the read order matching the
+                // importer's throw order (the two types are unrelated, so the
+                // ordering is documentation, not dispatch).
+                throw new ManagementCommandException(ex.Message);
+            }
             catch (System.Security.Cryptography.CryptographicException)
             {
                 throw new ManagementCommandException("Wrong passphrase or bundle was tampered.");
@@ -3632,6 +3643,17 @@ public class ManagementActor : ReceiveActor
             {
                 throw new ManagementCommandException(ex.Message);
             }
+            catch (BundleLockedException ex)
+            {
+                // Register row 51: the per-bundle 3-strike lockout. LoadAsync raises
+                // it from inside its own CryptographicException handler, so without
+                // this arm the operator saw MapFault's generic internal-error message
+                // plus a correlation id, never the reason. Listed ahead of the
+                // CryptographicException arm to keep the read order matching the
+                // importer's throw order (the two types are unrelated, so the
+                // ordering is documentation, not dispatch).
+                throw new ManagementCommandException(ex.Message);
+            }
             catch (System.Security.Cryptography.CryptographicException)
             {
                 throw new ManagementCommandException("Wrong passphrase or bundle was tampered.");

src/ZB.MOM.WW.ScadaBridge.Transport/Import/BundleLockedException.cs

@@ -1,31 +0,0 @@
-namespace ZB.MOM.WW.ScadaBridge.Transport.Import;
-
-/// <summary>
-/// T-003: thrown by <see cref="BundleImporter.LoadAsync"/> when an encrypted bundle has
-/// exceeded the configured failed-unlock attempt limit
-/// (<see cref="TransportOptions.MaxUnlockAttemptsPerSession"/>). The lockout is tracked
-/// server-side keyed by <c>BundleManifest.ContentHash</c>, so a second tab / CLI caller
-/// re-uploading the same bytes hits the same counter and cannot side-step the limit.
-/// </summary>
-public sealed class BundleLockedException : Exception
-{
-    /// <summary>Number of recorded unlock failures for this bundle.</summary>
-    public int FailedAttempts { get; }
-
-    /// <summary>SHA-256 (hex) of the bundle's content bytes, the lockout's tracking key.</summary>
-    public string BundleContentHash { get; }
-
-    /// <summary>
-    /// Initializes a new <see cref="BundleLockedException"/>.
-    /// </summary>
-    /// <param name="bundleContentHash">SHA-256 hex from <c>BundleManifest.ContentHash</c>.</param>
-    /// <param name="failedAttempts">Number of failures recorded against this bundle.</param>
-    public BundleLockedException(string bundleContentHash, int failedAttempts)
-        : base(
-            $"Bundle is locked after {failedAttempts} failed unlock attempts. "
-            + "Wait for the lockout window to expire or re-export the bundle to obtain a new content hash.")
-    {
-        BundleContentHash = bundleContentHash ?? throw new ArgumentNullException(nameof(bundleContentHash));
-        FailedAttempts = failedAttempts;
-    }
-}