Collapse NATS activity credentials into a single Connection string

Replaces separate Url/User/Password inputs on NatsPublish and NatsTrigger with
one Connection input in standard NATS URL form (e.g. nats://user:pass@host:4222,
wss://user:pass@host/). The activity's input description explains the format so
it renders as help text in the Studio property panel.

NatsConnectionCache now parses the connection string, keeps its cache keyed on
the parsed (url, user, password) tuple, and exposes ParseConnectionString for
reuse. NatsTriggerStimulus collapses to (Connection, Stream, Subject); existing
NATS workflows must be republished to re-index with the new stimulus shape.

CLAUDE.md

@@ -171,25 +171,33 @@ to its DSN.
 
 ## NATS activities
 
-Connection details (URL, user, password) live on the activity nodes themselves
-— configured per-node in the workflow designer, not in appsettings or env vars.
-Every stored trigger carries its own connection info; a `NatsConnectionCache`
-singleton hands out one `NatsConnection` per unique `(url, user, password)` so
-repeat invocations reuse the same TCP/TLS session.
+Connection details live on the activity nodes themselves — configured per-node
+in the workflow designer as a **single connection string** in the standard NATS
+URL form `<scheme>://[user:password@]host[:port]` (schemes: `nats`, `tls`,
+`ws`, `wss`). Every stored trigger carries its own connection string; a
+`NatsConnectionCache` singleton parses the string into `(cleanUrl, user,
+password)` and hands out one `NatsConnection` per unique tuple so repeat
+invocations reuse the same TCP/TLS session.
+
+Passwords with special characters (`@ : / #`) must be URL-encoded (`%40 %3A
+%2F %23`). The activity's input `Description` shows this in the Studio
+property panel.
 
 Files under `src/Elsa.CustomServer/`:
 
-- `Activities/NatsPublish.cs` — publisher `CodeActivity`. Inputs: `Url`,
-  `User`, `Password`, `Subject`, `Body`, optional `MessageId` (sets the
-  `Nats-Msg-Id` header for JetStream server-side dedup), optional
+- `Activities/NatsPublish.cs` — publisher `CodeActivity`. Inputs: `Connection`
+  (single connection string), `Subject`, `Body`, optional `MessageId` (sets
+  the `Nats-Msg-Id` header for JetStream server-side dedup), optional
   `ExpectedStream` (fail-fast assertion). Outputs `Sequence` and `Duplicate`.
-- `Activities/NatsTrigger.cs` — trigger `Trigger<string>`. Inputs: `Url`,
-  `User`, `Password`, `Stream`, `Subject` (wildcards allowed). Outputs:
-  `Result` = message body (UTF-8), `ReceivedSubject`, `Headers`. Its trigger
-  name / stimulus name is `NATS.NatsTrigger`; the stimulus record includes the
-  connection info so a message from server A only starts the workflows
+- `Activities/NatsTrigger.cs` — trigger `Trigger<string>`. Inputs:
+  `Connection`, `Stream`, `Subject` (wildcards allowed). Outputs: `Result` =
+  message body (UTF-8), `ReceivedSubject`, `Headers`. Its trigger name /
+  stimulus name is `NATS.NatsTrigger`; the stimulus record includes the
+  connection string so a message from server A only starts the workflows
   designed to listen on server A.
-- `Nats/NatsConnectionCache.cs` — singleton `(url, user, password) → NatsConnection` cache.
+- `Nats/NatsConnectionCache.cs` — singleton connection-string parser +
+  `(cleanUrl, user, password) → NatsConnection` cache. Exposes static
+  `ParseConnectionString(...)` for anyone else who needs the same split.
 - `Nats/NatsTriggerHostedService.cs` — one `BackgroundService` that scans
   `ITriggerStore` for stored triggers named `NATS.NatsTrigger`, spins up one
   durable pull consumer per unique stimulus, and dispatches workflows via
@@ -204,9 +212,16 @@ if multiple Elsa instances are running, exactly one processes each message
 (load-balanced), at-least-once. `MaxDeliver = 5`, `AckWait = 30s`,
 `MaxAckPending = 256`. Failed dispatches NAK with a 5-second delay.
 
-**Security note:** trigger stimuli — including the NATS password — are
-persisted in the trigger store DB. Don't log the stimulus record verbatim, and
-treat the trigger store with the same care as any secret storage.
+**Security note:** trigger stimuli — including the NATS connection string,
+which typically embeds the password — are persisted in the trigger store DB.
+Don't log the stimulus record verbatim, and treat the trigger store with the
+same care as any secret storage.
+
+**Migration note:** activities were changed from three fields
+(`Url / User / Password`) to a single `Connection` input. Any workflow authored
+against the old shape needs to be reopened in Studio and its NATS
+publish/trigger nodes re-filled — republishing then re-indexes the trigger
+store with the new stimulus shape.
 
 Package: `NATS.Net` (v2 client). The v1 `NATS.Client` package does not support
 `wss://` from .NET — do not use it.