fix(historian): #686 review — bounded, density-aware reverse raw walk; uncapped Gateway raw reads

1. Uncapped reverse raw read on a forward-only backend = ONE forward read of the
   window, filtered and reversed in memory (was a segment-by-segment walk).
2. Segment width is aimed at ~half the row budget from the density just observed
   (overflow: from the truncated read's own sample span) and carried page to page
   in HistoryContinuationState.SegmentWidthTicks.
3. The walk starts no later than now + 1 day and never reads before the epoch.
4. Request bounds are rounded outward to the millisecond, so a row AVEVA
   fabricates at a rounded-up query start cannot land inside the segment.
5. Budget M = max(1, MaxTieClusterOverfetch); reads ask M + 2 rows, completeness is
   'short OR last row past the segment', and a read crowded by rows before the
   segment is re-read once (<= 2M + 4). A cluster of exactly M, neighbouring
   clusters each within M, and M <= 1 are all served; only one timestamp over M
   is refused. ServerHistorianOptions text updated.
6. The raw and events tie-path oversized-cluster refusal is BadTooManyOperations
   (was BadHistoryOperationUnsupported), consistent with the walk.
7. GatewayHistorianDataSource.ReadRawAsync: a caller cancellation is not a backend
   failure; NumValuesPerNode = 0 is sent as int.MaxValue (the client package and
   the gateway reject max_values <= 0, so every uncapped Gateway raw read failed);
   a MaxValuesCeiling refusal is a HistoryReadLimitExceededException.
8. Tests: upper-edge filter, epoch floor, look-ahead, ms alignment, exact/adjacent
   clusters, minimal budget, carried density, and the walk over the real Gateway
   source + FakeHistorianGatewayClient (OpcUaServer internals visible to it).

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway/GatewayHistorianDataSource.cs

@@ -90,8 +90,9 @@ public sealed class GatewayHistorianDataSource : IHistorianDataSource, IAsyncDis
 
         try
         {
-            // The gateway seam caps with an int; OPC UA hands us a uint, so clamp to int range.
-            var maxValues = (int)Math.Min(maxValuesPerNode, int.MaxValue);
+            // The gateway seam caps with an int; OPC UA hands us a uint, so clamp to int range. 0 ("all values") is sent
+            // unbounded: the client package and the gateway reject max_values <= 0 (#686 review).
+            var maxValues = maxValuesPerNode == 0 ? int.MaxValue : (int)Math.Min(maxValuesPerNode, int.MaxValue);
             var samples = new List<HistorianSample>();
             await foreach (var sample in _client
                 .ReadRawAsync(fullReference, startUtc, endUtc, maxValues, cancellationToken)
@@ -104,6 +105,18 @@ public sealed class GatewayHistorianDataSource : IHistorianDataSource, IAsyncDis
             RecordOutcome(success: true, error: null);
             return new HistoryReadResult(snapshots, ContinuationPoint: null);
         }
+        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+        {
+            throw; // the caller (client cancel / HistoryReadDeadline) asked for this — not a backend fault
+        }
+        catch (Exception ex) when (IsMaxValuesCeilingRejection(ex))
+        {
+            // An unbounded read over Historian:ReadLimits:MaxValuesCeiling with AllowStreamingBeyondCeiling=false: a
+            // client-request limit (BadTooManyOperations), not a backend fault.
+            throw new HistoryReadLimitExceededException(maxValuesPerNode,
+                $"The HistorianGateway refused the row budget of the raw read of '{fullReference}' (its " +
+                "Historian:ReadLimits:MaxValuesCeiling); set NumValuesPerNode or narrow the window.");
+        }
         catch (Exception ex)
         {
             RecordReadFailure(ex);