Phase 8: Production readiness — failover tests, security hardening, sandboxing, deployment docs

- WP-1-3: Central/site failover + dual-node recovery tests (17 tests)
- WP-4: Performance testing framework for target scale (7 tests)
- WP-5: Security hardening (LDAPS, JWT key length, no secrets in logs) (11 tests)
- WP-6: Script sandboxing adversarial tests (28 tests, all forbidden APIs)
- WP-7: Recovery drill test scaffolds (5 tests)
- WP-8: Observability validation (structured logs, correlation IDs, metrics) (6 tests)
- WP-9: Message contract compatibility (forward/backward compat) (18 tests)
- WP-10: Deployment packaging (installation guide, production checklist, topology)
- WP-11: Operational runbooks (failover, troubleshooting, maintenance)
92 new tests, all passing. Zero warnings.

src/ScadaLink.ConfigurationDatabase/Services/InstanceLocator.cs

@@ -0,0 +1,33 @@
+using Microsoft.EntityFrameworkCore;
+using ScadaLink.Commons.Interfaces.Services;
+
+namespace ScadaLink.ConfigurationDatabase.Services;
+
+/// <summary>
+/// Resolves instance unique names to site identifiers using the configuration database.
+/// </summary>
+public class InstanceLocator : IInstanceLocator
+{
+    private readonly ScadaLinkDbContext _context;
+
+    public InstanceLocator(ScadaLinkDbContext context)
+    {
+        _context = context;
+    }
+
+    public async Task<string?> GetSiteIdForInstanceAsync(
+        string instanceUniqueName,
+        CancellationToken cancellationToken = default)
+    {
+        var instance = await _context.Set<Commons.Entities.Instances.Instance>()
+            .FirstOrDefaultAsync(i => i.UniqueName == instanceUniqueName, cancellationToken);
+
+        if (instance == null)
+            return null;
+
+        var site = await _context.Set<Commons.Entities.Sites.Site>()
+            .FindAsync(new object[] { instance.SiteId }, cancellationToken);
+
+        return site?.SiteIdentifier;
+    }
+}