Resolve all high-severity architecture review findings

src/ZB.MOM.WW.ScadaBridge.Communication/Grpc/AuditWireBudget.cs

@@ -0,0 +1,30 @@
+using Google.Protobuf;
+using Google.Protobuf.Collections;
+using Grpc.Core;
+
+namespace ZB.MOM.WW.ScadaBridge.Communication.Grpc;
+
+/// <summary>Bounds audit batches using complete protobuf row sizes, length/tag prefixes, and gRPC framing.</summary>
+public static class AuditWireBudget
+{
+    /// <summary>Five-byte gRPC frame plus two bytes reserved for a true MoreAvailable field.</summary>
+    public const int InitialBytes = 7;
+
+    /// <summary>
+    /// Appends one row to a field-1 repeated-message collection if it fits. A row larger than the
+    /// normal budget travels alone, up to the hard channel ceiling. Oversize rows are retained
+    /// locally and fail explicitly with their identity; they are never acknowledged or truncated.
+    /// </summary>
+    public static bool TryAppend<T>(RepeatedField<T> rows, T row, ref int wireBytes, string rowIdentity)
+        where T : IMessage<T>
+    {
+        var rowBytes = 1L + CodedOutputStream.ComputeMessageSize(row);
+        if (rows.Count > 0 && wireBytes + rowBytes > GrpcMessageLimits.AuditBatchBytes) return false;
+        if (rowBytes + InitialBytes > GrpcMessageLimits.MaxMessageBytes)
+            throw new RpcException(new Status(StatusCode.ResourceExhausted,
+                $"Audit row {rowIdentity} requires {rowBytes + InitialBytes} wire bytes, exceeding {GrpcMessageLimits.MaxMessageBytes}; retained locally. Reduce its payload or raise coordinated peer limits before retrying."));
+        rows.Add(row);
+        wireBytes += (int)rowBytes;
+        return true;
+    }
+}