Phase 8: Production readiness — failover tests, security hardening, sandboxing, deployment docs

- WP-1-3: Central/site failover + dual-node recovery tests (17 tests)
- WP-4: Performance testing framework for target scale (7 tests)
- WP-5: Security hardening (LDAPS, JWT key length, no secrets in logs) (11 tests)
- WP-6: Script sandboxing adversarial tests (28 tests, all forbidden APIs)
- WP-7: Recovery drill test scaffolds (5 tests)
- WP-8: Observability validation (structured logs, correlation IDs, metrics) (6 tests)
- WP-9: Message contract compatibility (forward/backward compat) (18 tests)
- WP-10: Deployment packaging (installation guide, production checklist, topology)
- WP-11: Operational runbooks (failover, troubleshooting, maintenance)
92 new tests, all passing. Zero warnings.

tests/ScadaLink.ExternalSystemGateway.Tests/ErrorClassifierTests.cs

@@ -0,0 +1,67 @@
+using System.Net;
+
+namespace ScadaLink.ExternalSystemGateway.Tests;
+
+/// <summary>
+/// WP-8: Tests for HTTP error classification.
+/// Transient: connection refused, timeout, HTTP 408/429/5xx.
+/// Permanent: HTTP 4xx (except 408/429).
+/// </summary>
+public class ErrorClassifierTests
+{
+    [Theory]
+    [InlineData(HttpStatusCode.InternalServerError, true)]
+    [InlineData(HttpStatusCode.BadGateway, true)]
+    [InlineData(HttpStatusCode.ServiceUnavailable, true)]
+    [InlineData(HttpStatusCode.GatewayTimeout, true)]
+    [InlineData(HttpStatusCode.RequestTimeout, true)]
+    [InlineData((HttpStatusCode)429, true)] // TooManyRequests
+    public void TransientStatusCodes_ClassifiedCorrectly(HttpStatusCode statusCode, bool expectedTransient)
+    {
+        Assert.Equal(expectedTransient, ErrorClassifier.IsTransient(statusCode));
+    }
+
+    [Theory]
+    [InlineData(HttpStatusCode.BadRequest, false)]
+    [InlineData(HttpStatusCode.Unauthorized, false)]
+    [InlineData(HttpStatusCode.Forbidden, false)]
+    [InlineData(HttpStatusCode.NotFound, false)]
+    [InlineData(HttpStatusCode.MethodNotAllowed, false)]
+    [InlineData(HttpStatusCode.Conflict, false)]
+    public void PermanentStatusCodes_ClassifiedCorrectly(HttpStatusCode statusCode, bool expectedTransient)
+    {
+        Assert.Equal(expectedTransient, ErrorClassifier.IsTransient(statusCode));
+    }
+
+    [Fact]
+    public void HttpRequestException_IsTransient()
+    {
+        Assert.True(ErrorClassifier.IsTransient(new HttpRequestException("Connection refused")));
+    }
+
+    [Fact]
+    public void TaskCanceledException_IsTransient()
+    {
+        Assert.True(ErrorClassifier.IsTransient(new TaskCanceledException("Timeout")));
+    }
+
+    [Fact]
+    public void TimeoutException_IsTransient()
+    {
+        Assert.True(ErrorClassifier.IsTransient(new TimeoutException()));
+    }
+
+    [Fact]
+    public void GenericException_IsNotTransient()
+    {
+        Assert.False(ErrorClassifier.IsTransient(new InvalidOperationException("bad input")));
+    }
+
+    [Fact]
+    public void AsTransient_CreatesCorrectException()
+    {
+        var ex = ErrorClassifier.AsTransient("test message");
+        Assert.IsType<TransientExternalSystemException>(ex);
+        Assert.Equal("test message", ex.Message);
+    }
+}