feat(dw-data-access): Dw.Api.psm1 shared connection module

[Justinvolved]

PR 3 of the default-scripts sequence, stacked on #91 (retarget after #91 merges, before its branch is deleted). Ships the shared-module half of the settled "shared vs self-contained" decision: one implementation of the Admin API / MCP / SQL-read plumbing the demo-build survey found re-implemented ~20 times. Version 4.24.0.

Scope decision (owner call): no scheduled-task SQL path. SQL is local-only — a hosted install exposes no SQL surface, and arbitrary SQL on a cloud install has no remediation short of a backup restore. The module therefore ships direct SQL readers for local installs and deliberately no RunSql scheduled-task runner or any other remote SQL path; management-api-and-sql.md states the rule.

Contents

• skills/dw-data-access/scripts/Dw.Api.psm1 — Connect-Dw / Assert-DwConnection (discovery order parameter > $env:DW_* > launchSettings.json > fail with the fix; load sentinel for the AMSI-blocked-import trap), Invoke-DwApi (UTF-8 byte bodies, depth-50, TLS bypass gated to localhost or explicit -AllowSelfSignedCertificate), Remove-DwDisplayOnlyMember (modelIdentifier/*Icon strip), Invoke-DwMcp / Get-DwMcpTools (handshake, mcp-session-id, SSE unwrap, cursor pagination), Get-DwSqlRows / Get-DwSqlScalar (raw SqlDataReader → pscustomobject; one-row results stay arrays; JSON-safe; LOCAL installs only), Clear-DwServiceCache, Set-DwDbConnectionTrust. Tokens masked everywhere.
• dw-data-access SKILL.md: compatibility: frontmatter, ## Scripts (scripts/) table, canonical import + assert form.
• Pointers: management-api-and-sql.md (wrapper section + the strip / unrolling / AMSI traps, plus the SQL-is-local-only rule) and dw-demo-base mcp-setup.md (JSON-RPC fallback) now name the module as the enforced form; the rules and the why stay in prose.
• marketplace.json: dw-data-access added to dynamicweb-commerce (bundle closure for the upcoming dw-search-indexing script); README bundle table updated.

Verification

• Validator exit 0; manifest in sync; module parses via [Parser]::ParseFile; Get-Help renders for all 10 exports; chore(validator): enforce the script contract #91's negative test confirms a cross-skill import from a bundle that does not ship dw-data-access errors.
• Live smoke against a local demo host (host started for the test and stopped after):
  • Connect-Dw -SolutionPath <solution> discovered the port from launchSettings.json; TLS bypass auto-gated on for localhost.
  • (Invoke-DwApi 'GetPageById?Id=1').model returned the model.
  • Get-DwMcpTools returned 393 tools (the documented 10.27.x count; > 200 gate).
  • Invoke-DwMcp 'get_shops' returned structuredContent.
  • Get-DwSqlRows on a one-row query returned Object[] of length 1 with PSCustomObject rows that serialize to JSON instantly; Get-DwSqlScalar returned the count.
  • Clear-DwServiceCache -CacheTypeName Dynamicweb.Ecommerce.Shops.ShopService succeeded.
  • Assert-DwConnection / Invoke-DwApi with nothing resolvable fail loudly with the fix one-liner.
  • Set-DwDbConnectionTrust was not exercised live (it rewrites the host's DB settings); it is a faithful lift of the proven demo-build script.