Resolve 6 of 7 stability review findings and close test coverage gaps

Fixes P1 StaComThread hang (crash-path faulting via WorkItem queue), P1 subscription
fire-and-forget (block+log or ContinueWith on 5 call sites), P2 continuation point
leak (PurgeExpired on Retrieve/Release), P2 dashboard bind failure (localhost prefix,
bool Start), P3 background loop double-start (task handles + join on stop in 3 files),
and P3 config logging exposure (SqlConnectionStringBuilder password masking). Adds
FakeMxAccessClient fault injection and 12 new tests. Documents required runtime
assemblies in ServiceHosting.md.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/ZB.MOM.WW.LmxOpcUa.Host/Historian/HistoryContinuationPoint.cs

@@ -15,7 +15,14 @@ namespace ZB.MOM.WW.LmxOpcUa.Host.Historian
         private static readonly ILogger Log = Serilog.Log.ForContext<HistoryContinuationPointManager>();
 
         private readonly ConcurrentDictionary<Guid, StoredContinuation> _store = new();
-        private readonly TimeSpan _timeout = TimeSpan.FromMinutes(5);
+        private readonly TimeSpan _timeout;
+
+        public HistoryContinuationPointManager() : this(TimeSpan.FromMinutes(5)) { }
+
+        internal HistoryContinuationPointManager(TimeSpan timeout)
+        {
+            _timeout = timeout;
+        }
 
         /// <summary>
         ///     Stores remaining data values and returns a continuation point identifier.
@@ -35,6 +42,7 @@ namespace ZB.MOM.WW.LmxOpcUa.Host.Historian
         /// </summary>
         public List<DataValue>? Retrieve(byte[] continuationPoint)
         {
+            PurgeExpired();
             if (continuationPoint == null || continuationPoint.Length != 16)
                 return null;
 
@@ -56,6 +64,7 @@ namespace ZB.MOM.WW.LmxOpcUa.Host.Historian
         /// </summary>
         public void Release(byte[] continuationPoint)
         {
+            PurgeExpired();
             if (continuationPoint == null || continuationPoint.Length != 16)
                 return;