fix(options): eager startup validation for AuditLog site sub-options — SiteWriter, SiteTelemetry, SiteRetention (plan R2-08 T5, arch-review 08r2 NF4)

src/ZB.MOM.WW.ScadaBridge.AuditLog/ServiceCollectionExtensions.cs

@@ -92,20 +92,23 @@ public static class ServiceCollectionExtensions
         // failures as AuditRedactionFailure on the site health report.
         services.TryAddSingleton<IAuditRedactionFailureCounter, NoOpAuditRedactionFailureCounter>();
 
-        // Site writer + telemetry options bindings.
-        // BindConfiguration is not used because the configuration root supplied
-        // by the caller may not be the application root — we go through the
-        // section explicitly so a partial IConfiguration (e.g. a test stub
-        // anchored on the AuditLog section's parent) still works.
-        services.AddOptions<SqliteAuditWriterOptions>()
-            .Bind(config.GetSection(SiteWriterSectionName));
-        services.AddOptions<SiteAuditTelemetryOptions>()
-            .Bind(config.GetSection(SiteTelemetrySectionName));
+        // Site writer + telemetry options bindings — now bind-and-validate via
+        // the shared helper so a bad site config fails fast at boot (NF4). The
+        // helper's GetSection(sectionPath) still resolves the section explicitly
+        // (NOT BindConfiguration), preserving the partial-config-root rationale:
+        // the caller's IConfiguration may be a test stub anchored on the AuditLog
+        // section's parent rather than the application root.
+        services.AddValidatedOptions<SqliteAuditWriterOptions, SqliteAuditWriterOptionsValidator>(
+            config, SiteWriterSectionName);
+        services.AddValidatedOptions<SiteAuditTelemetryOptions, SiteAuditTelemetryOptionsValidator>(
+            config, SiteTelemetrySectionName);
         // Retention purge options (the SiteAuditRetentionService hosted job is
-        // registered site-only in AddAuditLogHealthMetricsBridge). Binding here is
-        // inert on central — no hosted service consumes it there.
-        services.AddOptions<SiteAuditRetentionOptions>()
-            .Bind(config.GetSection(SiteAuditRetentionOptions.SectionName));
+        // registered site-only in AddAuditLogHealthMetricsBridge). The binding
+        // here is inert on central — no hosted service consumes it there — but
+        // the defaults validate clean, so eager validation on the central root is
+        // harmless.
+        services.AddValidatedOptions<SiteAuditRetentionOptions, SiteAuditRetentionOptionsValidator>(
+            config, SiteAuditRetentionOptions.SectionName);
 
         // SqliteAuditWriter is a singleton with a single owned SqliteConnection
         // and a background writer Task; multiple instances would race on the