feat(historian): #674 HistoryUpdate posture — future-skew bound, Primary gate, SqlServer v1 accepted, QuestDB TTL pin

- HistoryUpdate items with SourceTimestamp > now + ServerHistorian:HistoryUpdateMaxFutureSkew
  (default 1 day, <=0 disables) => BadOutOfRange in the node manager (every backend, never sent);
  clock injected via OtOpcUaNodeManager.Clock (host TimeProvider).
- HistoryUpdate is Primary-only: off-Primary => BadInvalidState per node, after authorization,
  same IDriverPrimaryRoleSource verdict as the native-ack gate; HistoryRead ungated.
- SqlServer: base schema requirement back to v1; SupportsModifiedTrail (v>=2). On v1 with
  AutoCreateSchema=false: writes/reads/events/retention work, modified reads + HistoryUpdate =>
  BadHistoryOperationUnsupported with nothing sent, retention skips SampleModified, one Warning per boot.
- QuestDB integration test pinning wall-clock TTL (far-future row evicts only partitions older
  than the TTL by the wall clock), with a positive control.
- Docs: Historian.md, Configuration.md, security.md, CLAUDE.md (incl. QuestDB retry duplicates,
  #674.4 anonymous-readable trail with ACL off, #674.5 not implemented).

Co-Authored-By: Claude <noreply@anthropic.com>

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OtOpcUaSdkServer.cs

@@ -83,6 +83,21 @@ public sealed class OtOpcUaSdkServer : StandardServer
         return true;
     }
 
+    /// <summary>
+    ///     Gitea #674 — wire the redundancy verdict that decides whether this node serves an OPC UA HistoryUpdate
+    ///     (<see cref="OtOpcUaNodeManager.HistoryUpdatePrimaryGate"/>); on any other node every authorized node of a
+    ///     HistoryUpdate is refused <c>BadInvalidState</c>. Passing <c>null</c> clears it (allow). No-op (returns
+    ///     <c>false</c>) when the node manager has not been created yet (mirrors <see cref="SetNativeAlarmAckPrimaryGate"/>).
+    /// </summary>
+    /// <param name="isPrimary">A cheap, non-blocking read of the data-plane Primary verdict; null to allow.</param>
+    /// <returns><c>true</c> when set on a live node manager; <c>false</c> when no node manager exists yet.</returns>
+    public bool SetHistoryUpdatePrimaryGate(Func<bool>? isPrimary)
+    {
+        if (_otOpcUaNodeManager is null) return false;
+        _otOpcUaNodeManager.HistoryUpdatePrimaryGate = isPrimary;
+        return true;
+    }
+
     /// <summary>
     ///     Wire the reverse-path gateway for inbound operator writes to writable equipment-tag nodes onto the
     ///     created <see cref="OtOpcUaNodeManager"/>. The host calls this after start with an