fix(historian): #686 review — bounded, density-aware reverse raw walk; uncapped Gateway raw reads

1. Uncapped reverse raw read on a forward-only backend = ONE forward read of the
   window, filtered and reversed in memory (was a segment-by-segment walk).
2. Segment width is aimed at ~half the row budget from the density just observed
   (overflow: from the truncated read's own sample span) and carried page to page
   in HistoryContinuationState.SegmentWidthTicks.
3. The walk starts no later than now + 1 day and never reads before the epoch.
4. Request bounds are rounded outward to the millisecond, so a row AVEVA
   fabricates at a rounded-up query start cannot land inside the segment.
5. Budget M = max(1, MaxTieClusterOverfetch); reads ask M + 2 rows, completeness is
   'short OR last row past the segment', and a read crowded by rows before the
   segment is re-read once (<= 2M + 4). A cluster of exactly M, neighbouring
   clusters each within M, and M <= 1 are all served; only one timestamp over M
   is refused. ServerHistorianOptions text updated.
6. The raw and events tie-path oversized-cluster refusal is BadTooManyOperations
   (was BadHistoryOperationUnsupported), consistent with the walk.
7. GatewayHistorianDataSource.ReadRawAsync: a caller cancellation is not a backend
   failure; NumValuesPerNode = 0 is sent as int.MaxValue (the client package and
   the gateway reject max_values <= 0, so every uncapped Gateway raw read failed);
   a MaxValuesCeiling refusal is a HistoryReadLimitExceededException.
8. Tests: upper-edge filter, epoch floor, look-ahead, ms alignment, exact/adjacent
   clusters, minimal budget, carried density, and the walk over the real Gateway
   source + FakeHistorianGatewayClient (OpcUaServer internals visible to it).

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Historian/ServerHistorianOptions.cs

@@ -81,8 +81,11 @@ public sealed class ServerHistorianOptions
     ///     cap). When a resume read stalls on such a cluster, the node manager over-fetches up to
     ///     <c>MaxTieClusterOverfetch + 1</c> ties at that single timestamp (a <c>start == end</c> read) and
     ///     pages through them; this bounds how large a single-timestamp burst the server will buffer in
-    ///     memory before it gives up and surfaces <c>BadHistoryOperationUnsupported</c> for that node. The
-    ///     default (65536) comfortably covers any realistic same-millisecond burst.
+    ///     memory before it gives up and surfaces <c>BadTooManyOperations</c> for that node (#686; was
+    ///     <c>BadHistoryOperationUnsupported</c>). It is also the per-read row budget of a reverse raw read walked
+    ///     back from forward reads on a backend that cannot read newest-first (the Gateway): one timestamp holding
+    ///     more samples than this is refused <c>BadTooManyOperations</c>. The default (65536) comfortably covers
+    ///     any realistic same-millisecond burst; a value below 1 is treated as 1.
     /// </summary>
     public int MaxTieClusterOverfetch { get; init; } = 65536;
 
@@ -167,7 +170,7 @@ public sealed class ServerHistorianOptions
         // the over-fetch code path only runs when a real IHistorianDataSource is wired in,
         // so a zero/negative value is harmless (and noise-free) when the historian is disabled.
         if (MaxTieClusterOverfetch <= 0)
-            warnings.Add($"ServerHistorian:MaxTieClusterOverfetch is {MaxTieClusterOverfetch} — must be > 0; HistoryRead-Raw cannot page within an oversized tie cluster and will surface BadHistoryOperationUnsupported for those reads.");
+            warnings.Add($"ServerHistorian:MaxTieClusterOverfetch is {MaxTieClusterOverfetch} — must be > 0 (treated as 1); HistoryRead-Raw and -Events cannot page within a tie cluster larger than that, and a Gateway reverse raw read cannot serve one timestamp holding more samples — those reads surface BadTooManyOperations.");
         // S3 HistoryRead concurrency knobs — a non-positive value disables the corresponding bound, so warn
         // (these gate the per-node fan-out / batch limiter that only run when a real data source is wired).
         if (HistoryReadBatchParallelism <= 0)