refactor(sf,site): both stores take ILocalDb instead of a connection string

Tasks 5 and 6 of the Phase 2 plan, committed together because their test
fallout is entangled — several fixtures construct both stores.

StoreAndForwardStorage and SiteStorageService now take ILocalDb. Connections
come from ILocalDb.CreateConnection(), which hands out an already-open,
pragma-configured connection carrying the zb_hlc_next() UDF the capture triggers
call; a raw connection would lack the UDF and every write to a replicated table
would fail closed. Deleted with the connection strings: S&F's
EnsureDatabaseDirectoryExists and its per-open busy_timeout pragma, and the site
service's BusyTimeoutFloorSeconds normalization — LocalDb owns all of it now.

DI: AddSiteRuntime's string overload is gone (nothing left to supply), so the
Host calls the no-arg form. ScadaBridge:Database:SiteDbPath and
StoreAndForwardOptions.SqliteDbPath survive only as the migrator's source
locations in Tasks 8/9.

Two things the plan did not anticipate, both worth reading:

1. FOUND A REAL LATENT DEFECT, from Phase 1, now fixed. The plan assumed
   directory creation simply moved to LocalDb along with file ownership. It did
   not: the LocalDb library never creates the parent directory, and
   SqliteLocalDb opens the file eagerly in its constructor — so a missing
   directory is a hard boot failure ("SQLite Error 14: unable to open database
   file"), not a degraded start. The default site config points at the RELATIVE
   path ./data/site-localdb.db, so any site node without a pre-existing data/
   directory fails to boot. The docker rig escapes only because its volume mount
   happens to create /app/data — a coincidence that would have hidden this until
   a bare-metal or fresh deployment. This has been latent since Phase 1 made
   LocalDb:Path required; deleting S&F's EnsureDatabaseDirectoryExists here
   would have widened it. Re-established the guarantee at the layer that now
   owns the path (SiteLocalDbDirectory.Ensure, called before AddZbLocalDb) and
   pinned it with SiteLocalDbDirectoryTests. Non-vacuity is not assumed: two
   tests written against the wrong assumption failed with exactly this
   SQLite Error 14 before the fix existed.

2. Test fallout was ~7x the plan's estimate. The plan named "fixtures" in one
   project; the constructor change actually reaches 40 files across 7 test
   projects, and most used Mode=Memory;Cache=Shared — which LocalDb has no
   equivalent for, so every one had to move to a real temp file. Rather than
   copy the Phase 1 TestLocalDb fixture into 7 projects, added a shared
   tests/ZB.MOM.WW.ScadaBridge.TestSupport library (not a test project) so the
   WAL-sidecar cleanup and the "real, not stubbed" rationale live in one place.

Retargeted rather than deleted, in both directions: the S&F WAL test now asserts
against the LocalDb-backed store (WAL genuinely is LocalDb's job), while the
directory-creation test moved to Host.Tests (that guarantee is NOT LocalDb's).
SiteStorageServiceTests.Initialize_EnablesWalJournalMode got the same treatment.
DeploymentManagerMediumFindingsTests induced a persistence failure via an
unopenable path, which no longer reaches the assertion since the fixture now
throws first; it induces the same failure shape via an uninitialized store.

Verified: full solution build 0 warnings; SiteRuntime 532, Host 318,
AuditLog 355, ExternalSystemGateway 142, HealthMonitoring 97,
StoreAndForward 153 — 1597 passed, 0 failed.

Claude-Session: https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts

tests/ZB.MOM.WW.ScadaBridge.IntegrationTests/RecoveryDrillTests.cs

@@ -3,6 +3,7 @@ using Microsoft.Extensions.Logging.Abstractions;
 using ZB.MOM.WW.ScadaBridge.Commons.Messages.Deployment;
 using ZB.MOM.WW.ScadaBridge.Commons.Types.Enums;
 using ZB.MOM.WW.ScadaBridge.StoreAndForward;
+using ZB.MOM.WW.ScadaBridge.TestSupport;
 
 namespace ZB.MOM.WW.ScadaBridge.IntegrationTests;
 
@@ -59,11 +60,15 @@ public class RecoveryDrillTests
         // Scenario: Communication drops while deploying system-wide artifacts.
         // The deployment command is buffered by S&F and retried when connection restores.
         var dbPath = Path.Combine(Path.GetTempPath(), $"sf_commdrop_{Guid.NewGuid():N}.db");
-        var connStr = $"Data Source={dbPath}";
+
+        // The store takes an ILocalDb (LocalDb has no in-memory mode), so the buffer
+        // lives in a real temp file for the duration of the drill.
+        TestLocalDb? localDb = null;
 
         try
         {
-            var storage = new StoreAndForwardStorage(connStr, NullLogger<StoreAndForwardStorage>.Instance);
+            localDb = TestLocalDb.Create(dbPath);
+            var storage = new StoreAndForwardStorage(localDb.Db, NullLogger<StoreAndForwardStorage>.Instance);
             await storage.InitializeAsync();
 
             var options = new StoreAndForwardOptions
@@ -102,8 +107,9 @@ public class RecoveryDrillTests
         }
         finally
         {
-            if (File.Exists(dbPath))
-                File.Delete(dbPath);
+            // Dispose before deleting — the master connection anchors the WAL sidecars.
+            localDb?.Dispose();
+            TestLocalDb.DeleteFiles(dbPath);
         }
     }
 
@@ -115,12 +121,17 @@ public class RecoveryDrillTests
         // On startup, the Deployment Manager Actor reads configs from SQLite and
         // recreates Instance Actors.
         var dbPath = Path.Combine(Path.GetTempPath(), $"sf_restart_{Guid.NewGuid():N}.db");
-        var connStr = $"Data Source={dbPath}";
+
+        // The restarted "process" opens its own local database over the SAME file — that
+        // is what this drill verifies survives.
+        TestLocalDb? preRestartDb = null;
+        TestLocalDb? restartedDb = null;
 
         try
         {
             // Pre-restart: S&F messages in buffer
-            var storage = new StoreAndForwardStorage(connStr, NullLogger<StoreAndForwardStorage>.Instance);
+            preRestartDb = TestLocalDb.Create(dbPath);
+            var storage = new StoreAndForwardStorage(preRestartDb.Db, NullLogger<StoreAndForwardStorage>.Instance);
             await storage.InitializeAsync();
 
             for (var i = 0; i < 3; i++)
@@ -140,7 +151,8 @@ public class RecoveryDrillTests
             }
 
             // Post-restart: new storage instance reads same DB
-            var restartedStorage = new StoreAndForwardStorage(connStr, NullLogger<StoreAndForwardStorage>.Instance);
+            restartedDb = TestLocalDb.Create(dbPath);
+            var restartedStorage = new StoreAndForwardStorage(restartedDb.Db, NullLogger<StoreAndForwardStorage>.Instance);
             await restartedStorage.InitializeAsync();
 
             var pending = await restartedStorage.GetMessagesForRetryAsync();
@@ -153,8 +165,10 @@ public class RecoveryDrillTests
         }
         finally
         {
-            if (File.Exists(dbPath))
-                File.Delete(dbPath);
+            // Dispose before deleting — the master connections anchor the WAL sidecars.
+            restartedDb?.Dispose();
+            preRestartDb?.Dispose();
+            TestLocalDb.DeleteFiles(dbPath);
         }
     }