refactor: address code review findings across all projects

Apply comprehensive fixes from code reviews including:
- Extract shared utilities (SqlFormatHelper, CellValueConverter, DbDestinationBase)
- Add interface abstractions (IAuthenticationService, IDatabaseMigrator, IMisQueryBuilder)
- Implement SecureStore for encrypted secrets storage
- Fix error handling with proper HTTP status codes and logging
- Optimize double enumeration in DevEtlRegistry
- Add DataSync.Dev README for developer onboarding
- Extract filter panel base classes to reduce duplication
- Update code review docs to mark all issues as fixed

CLAUDE.md

@@ -191,3 +191,26 @@ The **[db_info.md](db_info.md)** file contains connection information for the lo
 - Connection strings for .NET configuration
 
 **Note:** This file contains plain-text credentials for local development only. Do not commit to source control or use in production.
+
+## Coding Guidelines
+
+### DTOs and Models: Use Classes, Not Records
+
+This project uses **classes** (not C# records) for all DTOs, ViewModels, and model types. This convention provides:
+
+- **Consistency** - All model types follow the same pattern
+- **Explicit mutability** - Properties use `{ get; set; }` for clear intent
+- **Serialization compatibility** - Better compatibility with JSON serializers and Dapper
+- **Debugging ease** - Standard class behavior in debuggers and test assertions
+
+```csharp
+// Preferred: class with explicit properties
+public class WorkOrderViewModel
+{
+    public string OrderNumber { get; set; } = string.Empty;
+    public DateTime? CompletionDate { get; set; }
+}
+
+// Avoid: record types for DTOs
+public record WorkOrderViewModel(string OrderNumber, DateTime? CompletionDate);
+```