CLIENTS: ClientV2 - V2 Security Review Hardening Fixes

[cjdutoit]

Pre-release security review of ClientV2 and its V2 dependencies. Fixes 17 of the 24 review findings (V2 paths only; V1 out of scope). Each behavioural change was developed test-first (red/green). All suites green: Core unit 3023, Portal unit 130, EventHandlers unit 11, Core acceptance 63, EventHandlers acceptance 1. BasicApp, Portal, and SubstrateApi smoke-tested end-to-end.

High

• MAJOR FOUNDATIONS: Validations & Exception Handling #1 Quarantine-archive non-termination — the quarantine sweep now carries the same faultedEventV2Ids guard as the dead-event path, so an unarchivable row can no longer loop forever.
• MINOR ORCHESTRATIONS: Record Event Call Failures/Exceptions #2 Scheduled double-dispatch — atomic claim-before-fire. New TryClaimScheduledEventV2Async uses a conditional ExecuteUpdate (WHERE Type == Scheduled SET Type = Immediate); the losing racer gets 0 rows and skips. No schema change/migration. Proven under real concurrency by a new acceptance test (two parallel sweeps → exactly one dispatch).

Medium

• FEATURE REQUEST: Intelligent Resume / Smart Retry #4 Handler registry is now a thread-safe ConcurrentDictionary<Guid, IEventHandler> (idempotent register, snapshot GetAll()) — duplicate ids no longer poison dispatch.
• BROKERS: Select All Event Addresses #5 Replay sweep gained the retry sweep's attempted-id guard.
• MINOR FOUNDATIONS: Retrieve All Event Addresses #6 Event firing per-listener isolation + promoted-key split moved inside the try (a failure records an Error row for retry instead of aborting the loop).
• CLIENTS: Retrieve All Event Addresses #7 Opt-in per-handler timeout (DispatchConfiguration.HandlerTimeout, default infinite) so a hung handler can't wedge the sweeps.
• DOCUMENTATION: Update EventListner HowTo Documentation #8 Listener FilterCriteria length-capped at registration.
• MEDIUM FIX: Reinitialize Http Request For Each Call #9 Restore now preserves EventParticipantV2Id.
• CODE RUB: Foundations Namespace ListernEvents Spelling Error #10 IClientV2 is IAsyncDisposable and handler registration resolves a fresh scope per call.
• FEATURE: Support Timed Events #11 All V2 client catch-alls preserve a non-Xeption root cause (and its data) instead of dropping it.

Low

• DATA: Add & Migrate Event Listener V2 #18 Config-driven purge rejects RetentionDays < 1 (prevents immediate deletion of all archives).
• DATA: Add & Migrate Listener Event V2 #19 Archive mappers preserve UpdatedDate (was overwritten with CreatedDate).
• DATA: Add Event Call V2 #20 Scheduled sweep is paged by BatchSizeForBulkProcessing with an attempted-id guard.
• STATUS: Retrieve Scheduled Events V2s And Fire As Of 03-03-25 #21 Dropped ContactEmail/ContactPhone from the health participant report (PII).
• BROKERS: Insert Event V2 #22 IArchivingEventV2OrchestrationService and IListenerEventV2OrchestrationService restored to internal.
• BROKERS: Select All Events V2 #23 Corrected the secret model/Modify XML docs (write-once, hash-at-rest, rotate = remove + add).

Also included

• SubstrateApi: aligned the presented ParticipantSecret in appsettings with the seeded 36+ char value (a pre-existing mismatch, unrelated to the review, that broke submits on a fresh DB).

Not in this PR

#3 (secret hashing), #12 (V1 SSRF/retry — out of scope), #13/#14/#15 (secret-exposure cluster), #16/#17 (config/limits), #24 (info bundle).

closes #723