feat(grpc): site-side ICentralTransport seam + gRPC transport (T1A.3)

Introduce ICentralTransport as the site->central choke point inside
SiteCommunicationActor. The seven site->central sends (notification submit/
status, audit + cached-telemetry ingest, reconcile, health, heartbeat) now
delegate to an injected transport instead of owning ClusterClient.Send inline.

- AkkaCentralTransport: verbatim extraction of today's ClusterClient.Send path,
  including the exact sender-forwarding that routes central's reply straight
  back to the waiting Ask. Default when no transport is injected -> behaviour
  unchanged, existing SiteCommunicationActorTests pass as-is.
- GrpcCentralTransport + CentralChannelProvider: dial CentralControlService with
  sticky failover + background failback (1s-doubling-cap-60s), PSK +
  x-scadabridge-site via ControlPlaneCredentials, per-call deadlines mirroring
  today's Ask timeouts. Cross-node retry ONLY on provably-unsent
  connect failures; never on DeadlineExceeded. Heartbeat stays fire-and-forget.
- StaticSitePskProvider: site's single own-key provider (fail-closed).
- CommunicationOptions: CentralTransport flag (default Akka) + CentralGrpcEndpoints
  (validator: required when transport=Grpc). Host selects the impl; the
  ClusterClient is created only on the Akka path.

Tests: actor-with-fake-transport (7 delegations + fault routing + heartbeat
no-fault), AkkaCentralTransport sender-forwarding, GrpcCentralTransport over
in-process TestServer (failover flip, sticky, failback, PSK+header, deadline,
no-retry-on-deadline), validator. Communication.Tests 371 green, Host.Tests 391
green; the three above-seam suites pass unmodified.

src/ZB.MOM.WW.ScadaBridge.Communication/CommunicationOptions.cs

@@ -1,11 +1,44 @@
 namespace ZB.MOM.WW.ScadaBridge.Communication;
 
+/// <summary>
+/// Which transport carries the seven site→central control messages. Selected per node by
+/// <c>ScadaBridge:Communication:CentralTransport</c>; the migration ships with
+/// <see cref="Akka"/> as the default so nothing flips until a node opts in.
+/// </summary>
+public enum CentralTransportMode
+{
+    /// <summary>Akka <c>ClusterClient</c> — the transport in production today, and the default.</summary>
+    Akka = 0,
+
+    /// <summary>gRPC dial of the central <c>CentralControlService</c> (Phase 1A migration target).</summary>
+    Grpc = 1,
+}
+
 /// <summary>
 /// Configuration options for central-site communication, including per-pattern
 /// timeouts and transport heartbeat settings.
 /// </summary>
 public class CommunicationOptions
 {
+    /// <summary>
+    /// Which transport carries the site→central control messages. Default <see cref="CentralTransportMode.Akka"/>
+    /// (ClusterClient) — coexistence rule: a node flips to gRPC only by setting this to <c>Grpc</c>,
+    /// and rollback is flipping it back. Selecting <c>Grpc</c> requires <see cref="CentralGrpcEndpoints"/>.
+    /// </summary>
+    public CentralTransportMode CentralTransport { get; set; } = CentralTransportMode.Akka;
+
+    /// <summary>
+    /// Central control-plane gRPC endpoints (preferred first), e.g.
+    /// <c>["http://scadabridge-central-a:8083", "http://scadabridge-central-b:8083"]</c>. Dialled by
+    /// <see cref="Grpc.CentralChannelProvider"/> with sticky failover/failback. Required when
+    /// <see cref="CentralTransport"/> is <see cref="CentralTransportMode.Grpc"/>, ignored otherwise.
+    /// </summary>
+    /// <remarks>
+    /// Sites reach central by container/host name, NOT via Traefik (which is HTTP/1 only; gRPC is
+    /// h2c on the central node's dedicated <c>CentralGrpcPort</c>).
+    /// </remarks>
+    public List<string> CentralGrpcEndpoints { get; set; } = new();
+
     /// <summary>Timeout for deployment commands (typically longest due to apply logic).</summary>
     public TimeSpan DeploymentTimeout { get; set; } = TimeSpan.FromMinutes(2);