Fix runtime review findings

docs/GalaxyRepository.md

@@ -32,13 +32,14 @@ The service is defined in
 |-----|---------|
 | `TestConnection` | Connectivity probe. Returns `{ ok: bool }` after a `SELECT 1`. Does not throw on SQL failure — returns `ok = false`. Always hits SQL directly so it remains a true health check. |
 | `GetLastDeployTime` | Returns the cached `galaxy.time_of_last_deploy`. Served from the shared hierarchy cache; refreshed in the background. |
-| `DiscoverHierarchy` | Returns the full deployed hierarchy plus every object's dynamic attributes. **Served from cache** — see [Hierarchy Cache](#hierarchy-cache). |
+| `DiscoverHierarchy` | Returns one page of the deployed hierarchy plus each returned object's dynamic attributes. **Served from cache** — see [Hierarchy Cache](#hierarchy-cache). |
 | `WatchDeployEvents` | **Server-streaming.** The server emits the current state immediately on subscribe (so clients can bootstrap without waiting), then emits one event per detected deploy change. See [Deploy Notifications](#deploy-notifications). |
 
-`DiscoverHierarchy` is intentionally a single unary RPC rather than a stream:
-the row set is small (thousands of objects, low tens-of-thousands of
-attributes for typical Galaxies) and clients almost always want the whole tree
-at once.
+`DiscoverHierarchy` is a paged unary RPC. The raw request accepts `page_size`
+and `page_token`; the server defaults omitted page size to 1000 objects and
+caps every page at 5000 objects. Invalid page tokens and negative page sizes
+return `InvalidArgument`. Official high-level clients preserve the older
+"return the full hierarchy" behavior by looping pages internally.
 
 ## Hierarchy Cache
 
@@ -56,12 +57,14 @@ Refresh strategy is **deploy-time gated**:
 3. If the deploy timestamp is unchanged, the heavy hierarchy + attributes
    queries are **skipped**. The cache simply marks `LastSuccessAt`.
 4. If the deploy timestamp changed (or no data has loaded yet), the cache
-   pulls hierarchy + attributes, materializes a `DiscoverHierarchyReply`
-   once, replaces the entry atomically, and publishes a deploy event.
+   pulls hierarchy + attributes, materializes a Galaxy object list plus a
+   dashboard summary once, replaces the entry atomically, and publishes a
+   deploy event.
 
-Materializing the reply at refresh time means subsequent `DiscoverHierarchy`
-calls return a pre-built proto message — no per-request projection, no
-per-request allocations beyond the gRPC serializer's frame.
+Materializing objects and dashboard summaries at refresh time means subsequent
+`DiscoverHierarchy` calls page over an immutable object list. The dashboard
+uses the precomputed summary and does not rescan raw SQL rowsets on each
+snapshot.
 
 When SQL is unreachable, the cache retains the previous data and flips
 `Status` to `Stale` (or `Unavailable` if no data was ever loaded). A
@@ -139,6 +142,17 @@ message GalaxyAttribute {
   bool is_historized = 10;
   bool is_alarm = 11;
 }
+
+message DiscoverHierarchyRequest {
+  int32 page_size = 1;    // omitted/0 uses the server default of 1000
+  string page_token = 2;  // opaque offset token returned by the previous page
+}
+
+message DiscoverHierarchyReply {
+  repeated GalaxyObject objects = 1;
+  string next_page_token = 2;
+  int32 total_object_count = 3;
+}
 ```
 
 ### Contained Name vs Tag Name
@@ -176,7 +190,8 @@ GalaxyHierarchyRefreshService (BackgroundService)
     -> GalaxyRepository.GetLastDeployTimeAsync   (cheap, every tick)
     -> GalaxyRepository.GetHierarchyAsync         (only on deploy change)
     -> GalaxyRepository.GetAttributesAsync        (only on deploy change)
-    -> GalaxyProtoMapper.MapObject (materialize DiscoverHierarchyReply once)
+    -> GalaxyProtoMapper.MapObject (materialize GalaxyObject list once)
+    -> DashboardGalaxySummary (precompute dashboard counts once)
     -> IGalaxyDeployNotifier.Publish (only on deploy change)
 ```
 
@@ -189,8 +204,9 @@ Component breakdown:
   recursive CTEs and pick the most-derived attribute override per object.
 - `GalaxyHierarchyCache`
   (`src/MxGateway.Server/Galaxy/GalaxyHierarchyCache.cs`) holds the most
-  recent immutable `GalaxyHierarchyCacheEntry` (rows + materialized proto
-  reply + counts + status). All gRPC clients share the same entry.
+  recent immutable `GalaxyHierarchyCacheEntry` (materialized objects +
+  precomputed dashboard summary + counts + status). All gRPC clients share the
+  same entry.
 - `GalaxyHierarchyRefreshService`
   (`src/MxGateway.Server/Galaxy/GalaxyHierarchyRefreshService.cs`) is a
   hosted `BackgroundService` that drives `RefreshAsync` on the configured
@@ -220,6 +236,11 @@ Security`), but production deployments that use SQL authentication should set
 the override via environment variable rather than committing credentials to
 `appsettings.json`.
 
+The dashboard parses this connection string and displays only non-secret
+fields: server, database, integrated security, encrypt, and trust-server-
+certificate. It never displays user id, password, access token, or arbitrary
+unparsed connection string text.
+
 ## Authorization
 
 All four Galaxy RPCs (including `WatchDeployEvents`) require the