Connection dialog cleanup (post-#302)

[erikdarlingdata]

Follow-up cleanup after #302 (read-only intent feature by @ClaudioESSilva). No behavior change — just polish.

Changes

• Rename (Secondary) indicator to (Read-only) in QuerySessionControl. ApplicationIntent=ReadOnly requests secondary routing but doesn't guarantee it — the AG listener will still send the session to the primary if no readable replica is available. The label now reflects what we actually know (the user asked for read-only intent), not an assumption about topology.
• Deduplicate SqlConnectionStringBuilder construction. Previously the encrypt/trust/intent/auth logic was written twice — once in ServerConnection.GetConnectionString(ICredentialService, ...) for the runtime path, and once in ConnectionDialog.BuildConnectionString for the test path (which reads creds from the textboxes before they're saved). Added a GetConnectionString(string? username, string? password, string? databaseName = null) overload on ServerConnection; the credential-service overload now resolves creds and delegates to it, and the dialog calls it directly with textbox values. The dialog's BuildConnectionString is gone.
• XAML nits on the new Read-only intent checkbox: drop the redundant inner Margin="0,0,0,6" (the parent StackPanel already has Margin="0,0,0,12") and trim trailing whitespace.

Test plan

• dotnet build src/PlanViewer.Core — clean
• dotnet build src/PlanViewer.App — 4 pre-existing AVLN3001 warnings, no new ones
• dotnet build src/PlanViewer.Web — clean
• dotnet test — 75/75 pass
• Smoke-test in app: open ConnectionDialog, Test Connection still works for Windows, SQL Server, and Entra MFA auth modes
• Smoke-test in app: connect with Read-only intent checked, confirm ServerLabel shows (Read-only) after connect

[erikdarlingdata]

@ClaudioESSilva — small follow-up cleanup on top of your #302. No behavior change intended (the dialog test path now goes through the same ServerConnection.GetConnectionString that the runtime path uses, just with textbox creds passed in directly).

If you have a moment to smoke-test the Test Connection button across Windows / SQL Server / Entra MFA on your setup before this lands, that'd be appreciated since I don't have those auth modes available locally. No worries if not — happy to merge on green build + tests.