fix(opdb) use /api/export, not the non-existent paginated /api/machines

[jkeeley2073]

Summary

• Item 4 hand-off (Phase 2 § Scope) live-validation surfaced a regression in PR d9face6. The original OPDB integration was built against /api/machines?page=...&page_size=... — an endpoint that does not exist on the live OPDB API (404). PR d9face6's StubHandler faithfully pinned a contract that the real API never honored. Same failure pattern as PR refactor(stern) revert LinkRaw / BulletinRaw to positional records #72 / Item 6 (PR fix(stern) revert Playwright DTOs to classes — records broke live deserialization #75) — tests pinning a fiction.
• Live-API probing (separate from the codebase) confirmed /api/export is the actual bulk-machines endpoint: 200, single 2.4 MB JSON array, ~2,360 machines (the build-spec's "~12k" estimate was off by ~5×). /api/machines/{opdb_id} (single-machine lookup) and /api/changelog (incremental) work; /api/machines?page=... 404s.
• Fix: rewrite OpdbClient.StreamAllMachinesAsync as a single GET to /api/export + JsonSerializer.DeserializeAsyncEnumerable for streaming parse (no full materialization). Remove the now-dead OpdbOptions.PageSize (dead-config-grep clean). Bump OpdbOptions.HttpTimeoutSeconds default 60s → 120s.
• Resilience pipeline bump: the global AddStandardResilienceHandler in ServiceDefaults was configured with the Microsoft-default 30s TotalRequestTimeout / 10s AttemptTimeout, which guillotines OPDB's bulk export response (cold cache can take 30s+). Bumped to 120s / 50s / 120s CircuitBreaker.SamplingDuration. A per-client override on "OpdbClient-standard" was tried and proved a no-op — the named-options key behavior of ConfigureHttpClientDefaults doesn't match the obvious convention; the global bump is the simpler deterministic fix and benefits Stern Vue.js networkidle waits too (15–25s typical).
• Documented: decision-log DL-0003 captures the full PR d9face6 → Item 4 hand-off → revert history with a "revisit when" trigger; build-spec Phase 2 § Hand-off outcomes appended with the Item 4 outcome and the corrected machine count; docs/http-resilience-research.md gets a status note at the top reconciling the original "use per-client custom pipelines" recommendation against what actually shipped (bumped global defaults).

Changes

• src/PinballWizard.Infrastructure/Integrations/Opdb/OpdbClient.cs — StreamAllMachinesAsync rewritten; xmldoc rewritten; BuildPagedUrl helper deleted.
• src/PinballWizard.Infrastructure/Integrations/Opdb/ServiceCollectionExtensions.cs — comment updated to describe the inner-vs-outer relationship between HttpClient.Timeout and the resilience pipeline.
• src/PinballWizard.Core/Configuration/OpdbOptions.cs — PageSize removed; HttpTimeoutSeconds default 60s → 120s; xmldoc rewritten.
• src/PinballWizard.ServiceDefaults/Extensions.cs — AddStandardResilienceHandler configured with explicit timeout overrides (120s/50s/120s).
• tests/PinballWizard.Scraper.Tests/Integrations/Opdb/OpdbClientTests.cs — paginated tests replaced with HitsExportEndpoint_NotPaginatedMachines (asserts exactly one request to /api/export) + EmptyArray_YieldsNothing. PageSize removed from setup.
• tests/PinballWizard.Scraper.Tests/Integrations/Opdb/OpdbSyncServiceTests.cs — 9 SetResponseFor calls updated /api/machines?page=1&page_size=100 → /api/export. PageSize removed from setup.
• docs/decision-log.md — new DL-0003 entry.
• docs/build-spec.md — Phase 2 § Hand-off outcomes appended; "~12k" estimate corrected to "~2.4k" inline.
• docs/http-resilience-research.md — status note at the top.
• packages.lock.json files updated (CRLF normalization + checksum updates).

Work Item

No Jira/ADO ticket — PinballWizard is a personal Earlybird showcase project (no work-item tracker integration per feedback_personal_identity_only.md).

Test Plan

• dotnet build PinballWizard.slnx — clean, zero warnings
• dotnet test — 535 / 535 passing (was 534; -2 paginated-shape tests, +3 new tests)
• Standalone probe of https://opdb.org/api/export — 200, 2.4 MB, 2,359 records, expected DTO field shape
• Reviewer / post-merge: --source opdb --dry-run against deployed Cosmos succeeds — blocked at PR-creation time by an OPDB rate-limit window from validation probes; will run cleanly once the window clears (15–30 min). Same playbook as PR fix(stern) revert Playwright DTOs to classes — records broke live deserialization #75's games scrape.
• Reviewer / post-merge: --source opdb (apply mode) against deployed Cosmos verifies ~2,360 machines upserted to the machines container with full provenance.
• git log -1 --format='%an <%ae>': personal noreply identity confirmed
• /local-review: 0 🔴 / 3 ⚠️ / 7 ✅ — one ⚠️ addressed in-PR (http-resilience-research.md status note); two deferred as follow-ups with justification

Notes for Reviewer

• The headline pattern carried forward from PR fix(stern) revert Playwright DTOs to classes — records broke live deserialization #75: when wiring an external API, treat the live response shape as the contract. The StubHandler is a derivative of that, not its source of truth. PR d9face6's tests passed against SetResponseFor("/api/machines?page=1...") — the real API was never consulted at integration time. Item 4's deferred operational hand-off is what surfaced this — same dynamic as Item 6.
• The HitsExportEndpoint_NotPaginatedMachines test is the durable pin worth carrying forward: it stubs only /api/export AND asserts Assert.Single(_handler.Requests) with PathAndQuery == "/api/export". A future regression to pagination either 404s (no stub) or trips the Single() assertion — deterministic catch.
• Per-client resilience override didn't work, deserves a follow-up. I tried services.AddOptions<HttpStandardResilienceOptions>("OpdbClient-standard").Configure(...) and it silently no-op'd — the standard handler from ConfigureHttpClientDefaults doesn't read options bound to that key. Documented in DL-0003 alternatives-considered. The global bump is fine; if a future client genuinely needs different bounds, the right move is migrating away from ConfigureHttpClientDefaults to per-client AddResilienceHandler (which is what docs/http-resilience-research.md originally recommended). Not blocking this PR.
• Two deferred follow-ups (called out by /local-review and worth tracking): (a) malformed-row resilience — DeserializeAsyncEnumerable aborts on first bad row, killing the whole 2,360-row sync; wrap inner DTO read in try/catch + skip + counter. (b) Mid-stream cancellation test — framework-honored via token threading but not explicitly tested.
• Operational close: the deployed-Cosmos sync run was blocked at commit time by OPDB's rate limit. I'll attempt it again post-merge and post a confirmation comment with the actual machine count.

---

Generated with Claude Code

[jkeeley2073]

🟡 Operational sync still blocked by OPDB rate-limit; deferring to next session.

Post-push, attempted --source opdb --dry-run against deployed Cosmos at pinwiz-cosmos-dev-hlpz4. Hit the new 120s TotalRequestTimeout on Polly's retry-with-backoff chain. Direct probe of https://opdb.org/api/export confirms OPDB is returning HTTP 429 in 400 ms — a hard cooldown, not a transient delay. The validation probes done while diagnosing this PR's bug appear to have triggered a multi-hour throttle window.

The code fix in this PR remains correct — verified by:

• 535 / 535 unit tests passing (including the new pinning tests against /api/export)
• Standalone probe earlier in the session: 200, 2.4 MB, 2,359 records with the expected DTO field shape

Operational close deferred to a future session once OPDB's rate-limit window clears (likely tomorrow or after several hours of no traffic). Same playbook as PR #75's games scrape; will post a confirmation comment with the actual machine count when it runs cleanly.

This is the canonical "polite-by-construction" lesson: aggressive validation probes against a rate-limited API trade short-term diagnostic speed for medium-term operational lockout. For OPDB specifically, the per-source politeness override in data/seeds/ingestion_sources.v1.json is null — worth setting an explicit longer requestDelayMs for OPDB given the export endpoint's apparent sensitivity. Tracked as a follow-up.