Add read-only connection test endpoint

[smithaldon1]

Closes #209

Summary

• Add POST /connection-profiles/{profile_id}/test for read-only connection diagnostics.
• Add deterministic fake protocol clients for OPC-UA, MQTT, and BACnet test behavior before live adapters land.
• Return structured status, timing, readable messages, and protocol-specific diagnostics.
• Handle unreachable, invalid stored profile, disabled profile, and missing profile cases.
• Redact credential-like values and avoid returning configured secret/certificate reference names.
• Keep diagnostics separate from ingestion: testing a profile does not start polling, subscriptions, or event writes.

Test Evidence

• .venv/bin/python -m pytest services/api/tests/test_connection_profiles_api.py - passed, 16 tests.
• make test-integration - passed, 67 tests.
• make test - passed, 239 tests.
• make lint - passed.
• make typecheck - passed.
• make docs - passed placeholder docs target: "Docs are Markdown-only in the MVP skeleton; no docs checker is configured yet."
• git diff --check and git diff --cached --check - passed.

Docs Impact

• Updated services/api/README.md with the test endpoint and fake-client boundary.
• Updated docs/DATA_CONTRACTS.md with the diagnostic response contract.
• Updated docs/LEARNING_LOG.md.

Follow-up Work

• Implement 7. Feature: Add OPC-UA read-only adapter foundation #211 next: operator-console shell redesign.
• Keep live protocol adapters, tag/source browsing, and Workbench diagnostics pages out of this test endpoint PR.

[smithaldon1]

Reviewed and approved for merge