- Wrap Image.Load() in try-catch: ImageSharp throws UnknownImageFormatException
  when a non-image file is uploaded (never returns null as the old null check assumed)
- Return 400 Bad Request instead of propagating unhandled exception (500)

Upstream: dotnetcore/WTM#652

Part of #14

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…Filters [BUG-3]

- FileAttachment implements ITenant, so EF applies TenantCode query filter to all lookups
- Files uploaded by system admin (TenantCode=null) were invisible to tenant users because
  the filter WHERE TenantCode = 'tenant_a' excluded NULL-tenant files
- Fix: use IgnoreQueryFilters() in GetFile, DeleteFile, GetFileName so files are retrieved
  by ID regardless of tenant — file IDs (UUIDs) already serve as capability tokens

Upstream: dotnetcore/WTM#650

Part of #14

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Add Enabled property to CS config model (default: true for backward compatibility)
- Filter disabled connections in AddWtm startup loop (skip EnsureCreate)
- Wrap EnsureCreate() in try-catch so one bad connection doesn't block others
- Update GetCS() routing to exclude disabled connections and their read replicas
- Guard CreateDC() in WTMContext: throws clear InvalidOperationException when
  code attempts to use a disabled connection at runtime

Allows graceful degradation when Oracle or other secondary DB is unreachable.
Set Enabled: false in appsettings.json Connections array to disable a connection.

Part of #16

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…ols [BUG-8]

- BackgroundService runs 2s after startup, calls CanConnectAsync() on each
  enabled connection to pre-warm the connection pool
- Moves Oracle's ~60s cold start (TNS resolution, pool creation, ODP.NET
  metadata loading) from first user request to app boot (background)
- Fault-tolerant: logs warning on failure, never crashes app or blocks startup
- Respects BUG-7 Enabled toggle: skips disabled connections

Root cause: ODP.NET cold start includes TNS resolution, connection pool creation,
internal metadata loading, and self-tuning calibration — all on first Open().
Pre-warming with CanConnectAsync() during boot triggers all of this up front.

Part of #16

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- MySQL treats schema = database; applying the default Elsa schema name "Elsa"
  causes EF Core to look for a separate MySQL database that may not exist
- Fix: return null schema for MySQL (via ProviderName check), same as Oracle
- This allows Elsa to create its tables in the current MySQL database without
  a schema prefix

Upstream: dotnetcore/WTM#659

Part of #15

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…ironments [BUG-5]

- MainDir computation: fix crash when AppDomain.BaseDirectory lacks \bin\Debug\ or
  \bin\Release\ (e.g. dotnet run from repo root, Docker containers, published apps).
  Previous code set index=-1 and called Substring(0,-1) → ArgumentOutOfRangeException.
  Fix: fall back to Directory.GetCurrentDirectory() when bin path not found.
- GetAllModels(): guard against null DcConstructor (e.g. connections with Enabled=false
  from BUG-7 fix, or when no matching DataContext constructor is found via reflection).

Upstream: dotnetcore/WTM#661

Part of #15

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…G-6]

When the user provides a custom Items list with pre-set Selected=true flags
and no field model value or DefaultValue is resolved (selectVal is empty),
the previous code forced all items to Selected=false, ignoring the user's intent.

Fix: only override item selection state when selectVal has entries.
If selectVal is empty, the existing Selected values on items are preserved.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>