test(historian): live gate PASSED on docker-dev (SqlServer backend); CLI prints node-level HistoryUpdate result

Gate: Primary-only typed recording with real status, raw+UNS HistoryRead/Processed parity, HistoryUpdate
insert/duplicate/replace/delete + WriteOperate-only and anonymous denied, failover at 1x, Modbus device loss
stored as BadCommunicationError then a BadNoCommunication outage marker. Gate found the CLI hid the
node-level refusal code (fixed + pinned) and a pre-existing OpcUaClient comms-loss gap (filed separately).
docker-dev compose gains ServerHistorian__Backend / __SqlServer__ConnectionString (default Gateway).

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

tests/Client/ZB.MOM.WW.OtOpcUa.Client.CLI.Tests/HistoryUpdateCommandTests.cs

@@ -147,6 +147,23 @@ public class HistoryUpdateCommandTests
         TestConsoleHelper.GetOutput(console).ShouldContain("(no result returned)");
     }
 
+    /// <summary>
+    ///     A node the server refuses outright carries its reason in the node-level result with no per-item
+    ///     results; the CLI must print that reason, not just "(no result returned)" (found by the live gate).
+    /// </summary>
+    [Fact]
+    public async Task Execute_NodeLevelDenial_PrintsNodeResult()
+    {
+        var svc = new FakeOpcUaClientService
+        {
+            HistoryUpdateResult = new HistoryUpdateOutcome(StatusCodes.Good, [StatusCodes.BadUserAccessDenied], [])
+        };
+        using var console = TestConsoleHelper.CreateConsole();
+        await Should.ThrowAsync<CommandException>(async () =>
+            await Make(svc, values: ["1", "2"], times: TwoTimes).ExecuteAsync(console));
+        TestConsoleHelper.GetOutput(console).ShouldContain("Node result: BadUserAccessDenied");
+    }
+
     /// <summary>Fewer per-item results than items sent must not exit 0, even when every returned one is Good.</summary>
     [Fact]
     public async Task Execute_TooFewItemResults_Throws()