feat(config): reject a persisted Sql connectionString at the deploy gate (#498)

The Sql driver's "a pasted literal connection string is never persisted" guarantee was
enforced only on the READ path: SqlDriverConfigDto has no connectionString property and
UnmappedMemberHandling.Skip drops the key on deserialization. Nothing stopped it being
WRITTEN. Config blobs are schemaless JSON columns and the fallback authoring pattern for
a driver without a typed form is a raw-JSON textarea, so an operator pasting
{"connectionString":"Server=...;Password=..."} would put a live credential in the
ConfigDb — persisted, replicated to every node's artifact cache, readable by anyone with
config access — while the runtime silently ignored it and the driver failed to connect.
Discarding a secret on read is not the same as refusing to store it.

DraftValidator.ValidateSqlConnectionStringNotPersisted fails the deploy
(SqlConnectionStringPersisted) when a Sql-typed driver instance's DriverConfig, or the
DeviceConfig of any device beneath it, carries a top-level connectionString key.

- Both surfaces are checked because DeviceConfig is merged onto DriverConfig before the
  DTO sees it — a credential pasted into the device blob is the identical leak.
- The key is matched case-insensitively: System.Text.Json binds ConnectionString to a
  connectionString property by default, so an ordinal match would leave the obvious
  bypass open.
- Only the top level is scanned; the DTO is flat, so a nested occurrence cannot bind and
  is not the mistake this rule exists to catch.
- The message never echoes the value — validation errors reach the AdminUI, the deploy
  log and the audit trail, and repeating the string there would leak the credential the
  rule is refusing to store. Pinned by a test.
- Malformed/blank/non-object JSON never throws: a parse failure would take down every
  other rule in the same pass.

16 tests. Verified falsifiable — with the rule disabled the 6 positive assertions fail
and the 10 negatives stay green, so none of them passes vacuously.

Design §8.2's "if an inline connectionString is ever permitted (dev convenience only),
the AdminUI redacts it" carve-out is withdrawn in the same change: redaction only hides a
credential that has already been written.

Not covered, and filed as a follow-up: ClusterNode.DriverConfigOverridesJson is a third
persistence surface for a driver config blob, but it is not part of DraftSnapshot, so
this validator cannot see it.

docs/plans/2026-07-15-sql-poll-driver-design.md

@@ -607,8 +607,15 @@ comment) and the env-overridable ConfigDb connection string:
   file. Direct env read (not `IConfiguration`) is deliberate: the factory registry materializes
   drivers via a static `(id, json)` closure (Modbus pattern) with no `IConfiguration` in reach, so
   this keeps the factory shape unchanged.
-- If an inline `connectionString` is ever permitted (dev convenience only), the AdminUI **redacts** it
-  in display/logging and flags it dev-only.
+- **An inline `connectionString` is not permitted at all** — the earlier "dev convenience, redacted in
+  the UI" carve-out is withdrawn (Gitea #498). Redaction only hides a credential that has *already been
+  written* to the config DB and replicated to every node's artifact cache. `SqlDriverConfigDto` has no
+  such property and `UnmappedMemberHandling.Skip` drops the key on read, but that protects only the read
+  path; config blobs are schemaless JSON columns, so nothing stopped the key being **written**.
+  `DraftValidator.ValidateSqlConnectionStringNotPersisted` now fails the deploy
+  (`SqlConnectionStringPersisted`) for a `connectionString` key at the top level of a Sql driver's
+  `DriverConfig` **or** of the `DeviceConfig` of any device beneath it (the two are merged before the DTO
+  sees them). The key is matched case-insensitively, and the error text never echoes the value.
 - **Never log the resolved connection string.** Log only provider + server host + database name.
 - Prefer integrated/managed auth where the estate supports it (`Integrated Security=true` / Azure AD /
   Kerberos) so no password transits config at all.