fix(configuration): resolve Medium code-review findings (Configuration-002, -003, -006, -009)

Configuration-002: sp_PublishGeneration is transaction-nesting aware
(BEGIN TRANSACTION vs SAVE TRANSACTION on @@TRANCOUNT) so a caller's outer
transaction survives a publish failure; sp_ValidateDraft wrapped in TRY/CATCH.
Configuration-003: ValidatePathLength uses the cluster's actual Enterprise/Site
lengths when available, falling back to the conservative approximation.
Configuration-006: ResilientConfigReader treats a command-timeout
TaskCanceledException as a fault (not caller cancellation) and falls back.
Configuration-009: removed the checked-in plaintext sa connection string;
CreateDbContext now requires OTOPCUA_CONFIG_CONNECTION.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/Core/ZB.MOM.WW.OtOpcUa.Configuration/Migrations/20260417215224_StoredProcedures.cs

@@ -270,7 +270,22 @@ BEGIN
     SET NOCOUNT ON;
     SET XACT_ABORT ON;
 
-    BEGIN TRANSACTION;
+    -- Transaction-nesting awareness: if a caller (e.g. sp_RollbackToGeneration) already
+    -- holds a transaction, we use SAVE TRANSACTION so our failure path rolls back only to
+    -- the savepoint instead of issuing a bare ROLLBACK that wipes the caller's transaction
+    -- (which sets @@TRANCOUNT = 0 and causes error 3902 on the caller's subsequent COMMIT).
+    DECLARE @OwnsTxn  bit = 0;
+    DECLARE @SaveName nvarchar(32) = N'sp_PublishGeneration';
+
+    IF @@TRANCOUNT = 0
+    BEGIN
+        BEGIN TRANSACTION;
+        SET @OwnsTxn = 1;
+    END
+    ELSE
+    BEGIN
+        SAVE TRANSACTION sp_PublishGeneration;
+    END
 
     DECLARE @Lock nvarchar(255) = N'OtOpcUa_Publish_' + @ClusterId;
     DECLARE @LockResult int;
@@ -278,20 +293,22 @@ BEGIN
     IF @LockResult < 0
     BEGIN
         RAISERROR('PublishConflict: another publish is in progress for cluster %s', 16, 1, @ClusterId);
-        ROLLBACK;
+        IF @OwnsTxn = 1 ROLLBACK;
+        ELSE ROLLBACK TRANSACTION sp_PublishGeneration;
         RETURN;
     END
 
     -- sp_ValidateDraft signals every rejection with RAISERROR(..., 16, 1) — a severity-16 error is
     -- NOT batch-aborting and SET XACT_ABORT ON does not abort the transaction for it, so without a
     -- TRY/CATCH control would return here and the draft would publish despite failed validation.
-    -- Catch the validation error, roll back the publish transaction, and re-raise so the caller sees
-    -- the real validation failure.
+    -- Catch the validation error, roll back the publish transaction (only to our savepoint when a
+    -- caller owns the outer transaction), and re-raise so the caller sees the real validation failure.
     BEGIN TRY
         EXEC dbo.sp_ValidateDraft @DraftGenerationId = @DraftGenerationId;
     END TRY
     BEGIN CATCH
-        IF @@TRANCOUNT > 0 ROLLBACK;
+        IF @OwnsTxn = 1 ROLLBACK;
+        ELSE ROLLBACK TRANSACTION sp_PublishGeneration;
         THROW;
     END CATCH
 
@@ -324,15 +341,16 @@ BEGIN
 
     IF @@ROWCOUNT = 0
     BEGIN
-        RAISERROR('Draft %I64d for cluster %s not found (was it already published?)', 16, 1, @DraftGenerationId, @ClusterId);
-        ROLLBACK;
+        RAISERROR('Draft %I64d for cluster %s not in Draft status (was it already published?)', 16, 1, @DraftGenerationId, @ClusterId);
+        IF @OwnsTxn = 1 ROLLBACK;
+        ELSE ROLLBACK TRANSACTION sp_PublishGeneration;
         RETURN;
     END
 
     INSERT dbo.ConfigAuditLog (Principal, EventType, ClusterId, GenerationId)
     VALUES (SUSER_SNAME(), 'Published', @ClusterId, @DraftGenerationId);
 
-    COMMIT;
+    IF @OwnsTxn = 1 COMMIT;
 END
 ";