feat(historian): Part 11 modified-value history on SqlServer + QuestDB (#668)

Every HistoryUpdate a SQL backend applies now leaves a modification trail
(prior value, principal, Part 11 update type, modification time), and
HistoryReadRaw with IsReadModified=true serves it as HistoryModifiedData.

- Core: HistoryUpdateContext threaded into all three IHistorianDataUpdater
  methods; IHistorianDataSource.ReadModifiedAsync (default NotSupported =>
  BadHistoryOperationUnsupported on Gateway/Null); HistoryModified* contracts.
- SqlServer: schema v2 (002_sample_modified.sql, RequiredVersion=2, docs copy);
  trail written by OUTPUT ... INTO on the same MERGE/DELETE statement, so a
  failed update leaves no audit row; retention purges SampleModified per tag on
  the source-time cutoff; ReadModifiedAsync keyed on (SourceTimeUtc, ModifiedId).
- QuestDB: append-only {prefix}sample_modified (TTL like samples), trail row
  written BEFORE the change (orphan-on-crash, never an untracked change);
  existence reads now carry the prior value; ReadModifiedAsync.
- Node manager: modified reads dispatch + page via the #669 continuation store
  (HistoryContinuationState gains HistoryCursorKind + LastModifiedId), gated by
  the existing HistoryRead decision; session principal / key id passed to the
  updater. IsDeleteModified stays unsupported.
- Client.CLI: historyread --modified.
- Tests: node-manager dispatch/paging/cursor binding/principal threading,
  over-the-wire HistoryModifiedData, shared ModifiedValueConformance on both
  backends, SqlServer atomicity (forced trail failure => no change) + v1->v2
  upgrade + retention trail purge.
- Docs: Historian.md (Modified-value history section, schema v2 upgrade note),
  security.md, Client.CLI.md, CLAUDE.md.

tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/NodeManagerAclEnforcementTests.cs

@@ -89,6 +89,33 @@ public sealed class NodeManagerAclEnforcementTests : IDisposable
         finally { await host.DisposeAsync(); }
     }
 
+    /// <summary>
+    ///     #668: a modified-value read (<c>IsReadModified = true</c>) is gated by the SAME HistoryRead decision — no new
+    ///     operation. Denied without the bit; the granted principal reaches the backend (Null ⇒ unsupported, which is
+    ///     "allowed but no trail", a different fact from the denial).
+    /// </summary>
+    [Fact]
+    public async Task Modified_history_read_is_gated_by_the_history_read_grant()
+    {
+        var (host, server) = await BootAsync();
+        try
+        {
+            var nm = server.NodeManager!;
+            nm.HistorianDataSource = NullHistorianDataSource.Instance;
+            var nodeId = Historized(nm, "Plant/Modbus/dev1/Speed");
+
+            nm.Authorizer = Authorizer(enabled: true, GrantOn(NodePermissions.Read));
+            var (deniedResults, deniedErrors) = ReadRaw(nm, Identity(), modified: true, nodeId);
+            deniedErrors[0].StatusCode.Code.ShouldBe(StatusCodes.BadUserAccessDenied);
+            deniedResults[0].StatusCode.Code.ShouldBe(StatusCodes.BadUserAccessDenied);
+
+            nm.Authorizer = Authorizer(enabled: true, GrantOn(NodePermissions.HistoryRead));
+            var (_, allowedErrors) = ReadRaw(nm, Identity(), modified: true, nodeId);
+            allowedErrors[0].StatusCode.Code.ShouldBe(StatusCodes.BadHistoryOperationUnsupported);
+        }
+        finally { await host.DisposeAsync(); }
+    }
+
     /// <summary>A granted principal reads normally — the gate is not simply denying everything.</summary>
     [Fact]
     public async Task History_read_succeeds_for_a_granted_principal()
@@ -308,7 +335,11 @@ public sealed class NodeManagerAclEnforcementTests : IDisposable
     }
 
     private static (List<SdkHistoryReadResult> Results, List<ServiceResult> Errors) ReadRaw(
-        OtOpcUaNodeManager nm, IUserIdentity? identity, params NodeId[] nodeIds)
+        OtOpcUaNodeManager nm, IUserIdentity? identity, params NodeId[] nodeIds) =>
+        ReadRaw(nm, identity, modified: false, nodeIds);
+
+    private static (List<SdkHistoryReadResult> Results, List<ServiceResult> Errors) ReadRaw(
+        OtOpcUaNodeManager nm, IUserIdentity? identity, bool modified, params NodeId[] nodeIds)
     {
         var context = new OperationContext(
             new RequestHeader(), secureChannelContext: null, RequestType.HistoryRead, identity);
@@ -324,7 +355,7 @@ public sealed class NodeManagerAclEnforcementTests : IDisposable
                 StartTime = DateTime.UtcNow.AddHours(-1),
                 EndTime = DateTime.UtcNow,
                 NumValuesPerNode = 10,
-                IsReadModified = false,
+                IsReadModified = modified,
             },
             TimestampsToReturn.Both,
             releaseContinuationPoints: false,