fix(management): audit-config query returned {} for every filter — project the repo ValueTuple into a named result record

Deferred-work register row 46. HandleQueryAuditLog returned ICentralUiRepository's
(IReadOnlyList<AuditLogEntry> Entries, int TotalCount) ValueTuple straight to
ManagementActor.SerializeResult. System.Text.Json writes properties only, and a
ValueTuple exposes Item1/Item2 as public FIELDS, so the whole payload serialized to
the literal "{}" — the CLI faithfully printed an empty object no matter how many
AuditLogEntries rows matched, with no error anywhere in the stack.

Fixed at the handler (the layer that leaks the tuple), not the CLI: new Commons record
AuditLogQueryResult(Entries, TotalCount), mirroring the SecuredWriteListResult shape
already used by the other paged management query.

Also guards the whole class of bug: SerializeResult now throws on any ITuple result,
so the next handler that returns a tuple fails loudly instead of silently emitting {}.

Tests (fail-before verified — the query test asserted exactly "{}"):
- QueryAuditLogCommand_ReturnsEntriesAndTotalCount
- SerializeResult_TupleResult_ThrowsInsteadOfEmittingEmptyObject
- SerializeResult_AuditLogQueryResult_EmitsEntriesAndTotalCount

Docs: Component-CLI.md + CLI README document the response shape and why it is a record.

docs/requirements/Component-CLI.md

@@ -241,6 +241,13 @@ warning; migrate scripts to `audit-config`.
 scadabridge audit-config query [--user <username>] [--entity-type <type>] [--action <action>] [--from <date>] [--to <date>] [--page <n>] [--page-size <n>]
 ```
 
+The response is an `AuditLogQueryResult` — `{ "entries": [ … ], "totalCount": <n> }`, where
+`totalCount` is the unpaged match count. The result type is a named record specifically
+because the handler must not return the repository's `(Entries, TotalCount)` ValueTuple:
+`System.Text.Json` serializes properties only, so a tuple result renders as the literal
+`{}` and every query looks empty regardless of how many rows matched. `ManagementActor.SerializeResult`
+now rejects tuple results outright so the failure mode cannot recur silently.
+
 The new centralized Audit Log component (#23) is exposed via the `scadabridge audit` group below.
 
 ### Centralized Audit Commands