fix(management): audit-config query returned {} for every filter — project the repo ValueTuple into a named result record

Deferred-work register row 46. HandleQueryAuditLog returned ICentralUiRepository's
(IReadOnlyList<AuditLogEntry> Entries, int TotalCount) ValueTuple straight to
ManagementActor.SerializeResult. System.Text.Json writes properties only, and a
ValueTuple exposes Item1/Item2 as public FIELDS, so the whole payload serialized to
the literal "{}" — the CLI faithfully printed an empty object no matter how many
AuditLogEntries rows matched, with no error anywhere in the stack.

Fixed at the handler (the layer that leaks the tuple), not the CLI: new Commons record
AuditLogQueryResult(Entries, TotalCount), mirroring the SecuredWriteListResult shape
already used by the other paged management query.

Also guards the whole class of bug: SerializeResult now throws on any ITuple result,
so the next handler that returns a tuple fails loudly instead of silently emitting {}.

Tests (fail-before verified — the query test asserted exactly "{}"):
- QueryAuditLogCommand_ReturnsEntriesAndTotalCount
- SerializeResult_TupleResult_ThrowsInsteadOfEmittingEmptyObject
- SerializeResult_AuditLogQueryResult_EmitsEntriesAndTotalCount

Docs: Component-CLI.md + CLI README document the response shape and why it is a record.

src/ZB.MOM.WW.ScadaBridge.ManagementService/ManagementActor.cs

@@ -90,10 +90,35 @@ public class ManagementActor : ReceiveActor
     /// Serializes a command result to JSON using <see cref="System.Text.Json"/> — the same
     /// serializer the HTTP endpoint uses — with cycle-safe settings.
     /// </summary>
+    /// <remarks>
+    /// Rejects tuple results outright. <see cref="System.Text.Json"/> writes only
+    /// properties by default, and a <c>ValueTuple</c> exposes its members as public
+    /// <em>fields</em> — so a handler that returns a repository's
+    /// <c>(rows, totalCount)</c> tuple serializes to the literal <c>{}</c>, silently
+    /// handing every caller an empty result with no error anywhere in the stack. That is
+    /// exactly how <c>audit-config query</c> shipped broken (deferred-work register row
+    /// 46). Failing loudly here converts the whole class of bug into an immediate,
+    /// obvious error the first time the handler is exercised; the fix is always to
+    /// project the tuple into a named result record before returning it.
+    /// </remarks>
     /// <param name="result">The command result object to serialize, or null.</param>
     /// <returns>The JSON string representation of <paramref name="result"/>, or <c>"null"</c> when null.</returns>
-    public static string SerializeResult(object? result) =>
-        JsonSerializer.Serialize(result, ResultSerializerOptions);
+    /// <exception cref="InvalidOperationException">
+    /// Thrown when <paramref name="result"/> is a tuple, which cannot round-trip through
+    /// the JSON contract.
+    /// </exception>
+    public static string SerializeResult(object? result)
+    {
+        if (result is System.Runtime.CompilerServices.ITuple)
+        {
+            throw new InvalidOperationException(
+                $"Management command results must be named types, not tuples — "
+                + $"System.Text.Json serializes '{result.GetType().Name}' to '{{}}' because tuple "
+                + "members are fields, not properties. Project the tuple into a result record.");
+        }
+
+        return JsonSerializer.Serialize(result, ResultSerializerOptions);
+    }
 
     private void HandleEnvelope(ManagementEnvelope envelope)
     {
@@ -2578,12 +2603,24 @@ public class ManagementActor : ReceiveActor
     // Audit Log handler
     // ========================================================================
 
+    /// <summary>
+    /// Queries the configuration-change audit trail and projects the repository's
+    /// ValueTuple into <see cref="AuditLogQueryResult"/>.
+    /// </summary>
+    /// <remarks>
+    /// The projection is load-bearing, not cosmetic: returning the repository tuple
+    /// directly made <see cref="SerializeResult"/> emit the literal <c>{}</c> (ValueTuple
+    /// exposes <c>Item1</c>/<c>Item2</c> as fields, which System.Text.Json skips), so
+    /// <c>audit-config query</c> reported an empty result for every filter combination
+    /// regardless of how many rows matched — deferred-work register row 46.
+    /// </remarks>
     private static async Task<object?> HandleQueryAuditLog(IServiceProvider sp, QueryAuditLogCommand cmd)
     {
         var repo = sp.GetRequiredService<ICentralUiRepository>();
-        return await repo.GetAuditLogEntriesAsync(
+        var (entries, totalCount) = await repo.GetAuditLogEntriesAsync(
             cmd.User, cmd.EntityType, cmd.Action, cmd.From, cmd.To,
             page: cmd.Page, pageSize: cmd.PageSize);
+        return new AuditLogQueryResult(entries, totalCount);
     }
 
     // ========================================================================