fix(centralui): enforce site scoping on AlarmSummary — filter site list + deny out-of-scope alarm fetches, mirroring DebugView (arch-review 2026-08-19 P6-2 High)

AlarmSummary.razor was gated RequireDeployment but never consulted
SiteScopeService: the site picker listed every site unfiltered and
GetSiteAlarmsAsync ran for whatever siteId the onchange event carried,
so a Deployer scoped to one site could watch any site's live alarms
(including CurrentValue/LimitValue process data). The page was missed
by the ad0100f2 scoping survey.

Fix mirrors EventLogs.razor/DebugView.razor: OnInitializedAsync filters
_sites through SiteScope.FilterSitesAsync, and both the site-change
handler and RefreshAsync (the shared fetch path used by the manual
refresh button and the 15s poll timer) independently re-check the
selected site against the filtered list before ever calling
AlarmSummaryService, denying/resetting an out-of-scope id rather than
merely hiding it from the dropdown.

Tests: bUnit render tests added to AlarmSummaryRenderTests.cs proving
(1) a scoped Deployer's picker omits the out-of-scope site and (2) a
forged out-of-scope onchange value is denied — no row renders and
GetSiteAlarmsAsync is never called for that site. AlarmSummaryVirtualizeTests.cs
updated to register the now-required SiteScopeService.

tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/Monitoring/AlarmSummaryRenderTests.cs

@@ -67,6 +67,7 @@ public class AlarmSummaryRenderTests : BunitContext
         Services.AddSingleton(_siteRepo);
 
         Services.AddSingleton<ISiteAlarmLiveCache>(_liveCache);
+        Services.AddScoped<ZB.MOM.WW.ScadaBridge.CentralUI.Auth.SiteScopeService>();
 
         var claims = new[]
         {
@@ -278,6 +279,53 @@ public class AlarmSummaryRenderTests : BunitContext
         });
     }
 
+    // ── arch-review P6-2: site scoping (a scoped Deployer must not watch another
+    //    site's live alarms — the page was missed by the ad0100f2 scoping survey) ──
+
+    [Fact]
+    public void SiteScoping_ScopedDeploymentUser_SeesOnlyPermittedSiteInPicker()
+    {
+        var scopedUser = new ClaimsPrincipal(new ClaimsIdentity(new[]
+        {
+            new Claim(JwtTokenService.UsernameClaimType, "scoped"),
+            new Claim(JwtTokenService.RoleClaimType, "Deployer"),
+            new Claim(JwtTokenService.SiteIdClaimType, "1"), // Site 1 only
+        }, "TestAuth"));
+        Services.AddSingleton<AuthenticationStateProvider>(new TestAuthStateProvider(scopedUser));
+
+        var cut = Render<AlarmSummaryPage>();
+
+        var options = cut.FindAll("[data-test='alarm-summary-site'] option");
+        // "Select site…" placeholder + Site 1 only — Site 2 must not appear.
+        Assert.Equal(2, options.Count);
+        Assert.DoesNotContain("Site 2", cut.Markup);
+    }
+
+    [Fact]
+    public void SiteScoping_ForgedOutOfScopeSiteId_IsDeniedNotFetched()
+    {
+        // The picker never renders Site 2 for this user, but the change handler
+        // must independently reject an out-of-scope id arriving via any onchange
+        // value (e.g. a forged one, since Blazor Server processes the SignalR
+        // event server-side) rather than trusting it because it came through the
+        // <select> element.
+        var scopedUser = new ClaimsPrincipal(new ClaimsIdentity(new[]
+        {
+            new Claim(JwtTokenService.UsernameClaimType, "scoped"),
+            new Claim(JwtTokenService.RoleClaimType, "Deployer"),
+            new Claim(JwtTokenService.SiteIdClaimType, "1"), // Site 1 only
+        }, "TestAuth"));
+        Services.AddSingleton<AuthenticationStateProvider>(new TestAuthStateProvider(scopedUser));
+
+        var cut = Render<AlarmSummaryPage>();
+        cut.Find("[data-test='alarm-summary-site']").Change("2"); // out-of-scope, forged
+
+        // Denied server-side: no alarm table renders, selection resets to empty.
+        Assert.Empty(cut.FindAll("tr[data-test='alarm-summary-row']"));
+        Assert.NotNull(cut.Find("[data-test='alarm-summary-empty']"));
+        _summary.DidNotReceive().GetSiteAlarmsAsync(2, Arg.Any<CancellationToken>());
+    }
+
     // ── arch-review R2 N7: disposal guard on the live callback ─────────────────
 
     [Fact]

tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/Monitoring/AlarmSummaryVirtualizeTests.cs

@@ -49,6 +49,7 @@ public class AlarmSummaryVirtualizeTests : BunitContext
             }));
         Services.AddSingleton(_siteRepo);
         Services.AddSingleton<ISiteAlarmLiveCache>(new InertLiveCache());
+        Services.AddScoped<ZB.MOM.WW.ScadaBridge.CentralUI.Auth.SiteScopeService>();
 
         var claims = new[]
         {