fix(configuration): resolve Medium code-review findings (Configuration-002, -003, -006, -009)

Configuration-002: sp_PublishGeneration is transaction-nesting aware
(BEGIN TRANSACTION vs SAVE TRANSACTION on @@TRANCOUNT) so a caller's outer
transaction survives a publish failure; sp_ValidateDraft wrapped in TRY/CATCH.
Configuration-003: ValidatePathLength uses the cluster's actual Enterprise/Site
lengths when available, falling back to the conservative approximation.
Configuration-006: ResilientConfigReader treats a command-timeout
TaskCanceledException as a fault (not caller cancellation) and falls back.
Configuration-009: removed the checked-in plaintext sa connection string;
CreateDbContext now requires OTOPCUA_CONFIG_CONNECTION.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/Core/ZB.MOM.WW.OtOpcUa.Configuration/LocalCache/ResilientConfigReader.cs

@@ -48,7 +48,13 @@ public sealed class ResilientConfigReader
                 UseJitter = true,
                 Delay = TimeSpan.FromMilliseconds(100),
                 MaxDelay = TimeSpan.FromSeconds(1),
-                ShouldHandle = new PredicateBuilder().Handle<Exception>(ex => ex is not OperationCanceledException),
+                // Handle ALL exceptions including OperationCanceledException. A SQL command-level
+                // timeout surfaces as TaskCanceledException (derives from OperationCanceledException)
+                // when the caller's token is NOT cancelled, and must be retried just like any other
+                // transient error. Polly itself checks the cancellation token between retries and
+                // stops with OperationCanceledException on genuine caller cancellation regardless of
+                // this predicate.
+                ShouldHandle = new PredicateBuilder().Handle<Exception>(),
             });
         }
 
@@ -76,7 +82,11 @@ public sealed class ResilientConfigReader
             _staleFlag.MarkFresh();
             return result;
         }
-        catch (Exception ex) when (ex is not OperationCanceledException)
+        // Catch all exceptions that are NOT genuine caller cancellations. A SQL command-level
+        // timeout surfaces as TaskCanceledException (derives from OperationCanceledException)
+        // but the caller's token is NOT cancelled — we must fall back to the sealed cache for
+        // that case, not propagate. Only rethrow if the caller actually requested cancellation.
+        catch (Exception ex) when (ex is not OperationCanceledException || !cancellationToken.IsCancellationRequested)
         {
             _logger.LogWarning(ex, "Central-DB read failed after retries; falling back to sealed cache for cluster {ClusterId}", clusterId);
             // GenerationCacheUnavailableException surfaces intentionally — fails the caller's