fix(correctness): close Theme 10 — 5 data-integrity / serialisation findings

Final themed batch. 5 well-localised correctness fixes.

Serialisation precision:
- ESG-020: DatabaseGateway.JsonElementToParameterValue probes
  TryGetInt64 → TryGetDecimal → GetDouble, so a script's high-precision
  decimal SQL parameter survives the cached-write retry round-trip
  without silent precision loss. 3 new regression tests.

Template engine correctness:
- TE-018: DiffService gains ComputeConnectionsDiff over
  FlattenedConfiguration.Connections, mirroring the existing entity-diff
  shape and pairing with the Theme 1 TE-017 hash-coverage fix. A
  ConfigurationDiff record extension in Commons is flagged as a follow-up.
- TE-019: TemplateResolver.BuildInheritanceChain now walks via the
  int? ParentTemplateId directly — only null means "no parent". A real
  Id of 0 (the prior special-cased sentinel) now walks the chain like
  any other node, matching the TemplateEngine-013 CycleDetector fix.
  Regression of TE-013 closed.
- TE-020: All 5 Create* paths in TemplateService + SharedScriptService
  re-ordered to save-first → log-with-real-Id → save-audit (matching
  the InstanceService pattern). Create* audit rows no longer carry a
  literal "0" EntityId.

Doc deferral:
- Transport-012: Component-Transport.md §Audit Trail now spells out that
  the BundleImportId repository filter IS wired (in CentralUiRepository),
  but the Audit-Log-Viewer UI dropdown + summary-row hyperlink are a
  deferred CentralUI follow-up. CLI workaround documented
  (audit query --bundle-import-id).

11+ new regression tests (3 ESG, 4 DiffService, 3 TemplateResolver, 4
TemplateService, 1 SharedScriptService). Build clean; ESG 72/72,
TemplateEngine 324/324. README regenerated: 1 pending of 481 total.

Session-to-date: 135 of 136 originally-open Theme findings closed
across 10 themes in 10 commits.

tests/ScadaLink.TemplateEngine.Tests/SharedScriptServiceTests.cs

@@ -156,4 +156,48 @@ public class SharedScriptServiceTests
     {
         Assert.Null(SharedScriptService.ValidateSyntax(code));
     }
+
+    // --- TemplateEngine-020 regression: audit row carries the real script Id ---
+
+    [Fact]
+    public async Task CreateSharedScript_AuditRowCarriesRealScriptIdNotLiteralZero()
+    {
+        // Pre-020: AddSharedScriptAsync → LogAsync("0", ...) → SaveChangesAsync.
+        // The audit row was queued with EntityId = "0" because EF Core had
+        // not yet populated the auto-generated key. Post-020: save first,
+        // then log with the real Id, then save the audit row.
+        _repoMock.Setup(r => r.GetSharedScriptByNameAsync("Helpers", It.IsAny<CancellationToken>()))
+            .ReturnsAsync((SharedScript?)null);
+
+        SharedScript? added = null;
+        _repoMock.Setup(r => r.AddSharedScriptAsync(It.IsAny<SharedScript>(), It.IsAny<CancellationToken>()))
+            .Callback<SharedScript, CancellationToken>((s, _) => added = s)
+            .Returns(Task.CompletedTask);
+        _repoMock.Setup(r => r.SaveChangesAsync(It.IsAny<CancellationToken>()))
+            .Callback<CancellationToken>(_ =>
+            {
+                if (added != null && added.Id == 0) added.Id = 314;
+            })
+            .ReturnsAsync(1);
+
+        string? auditedEntityId = null;
+        _auditMock.Setup(a => a.LogAsync(
+                It.IsAny<string>(),
+                "Create",
+                "SharedScript",
+                It.IsAny<string>(),
+                It.IsAny<string>(),
+                It.IsAny<object?>(),
+                It.IsAny<CancellationToken>()))
+            .Callback<string, string, string, string, string, object?, CancellationToken>(
+                (_, _, _, entityId, _, _, _) => auditedEntityId = entityId)
+            .Returns(Task.CompletedTask);
+
+        var result = await _service.CreateSharedScriptAsync(
+            "Helpers", "public static int Add(int a, int b) { return a + b; }", null, null, "admin");
+
+        Assert.True(result.IsSuccess);
+        Assert.Equal("314", auditedEntityId);
+        Assert.NotEqual("0", auditedEntityId);
+    }
 }