feat(grpc): site-side ICentralTransport seam + gRPC transport (T1A.3)

Introduce ICentralTransport as the site->central choke point inside
SiteCommunicationActor. The seven site->central sends (notification submit/
status, audit + cached-telemetry ingest, reconcile, health, heartbeat) now
delegate to an injected transport instead of owning ClusterClient.Send inline.

- AkkaCentralTransport: verbatim extraction of today's ClusterClient.Send path,
  including the exact sender-forwarding that routes central's reply straight
  back to the waiting Ask. Default when no transport is injected -> behaviour
  unchanged, existing SiteCommunicationActorTests pass as-is.
- GrpcCentralTransport + CentralChannelProvider: dial CentralControlService with
  sticky failover + background failback (1s-doubling-cap-60s), PSK +
  x-scadabridge-site via ControlPlaneCredentials, per-call deadlines mirroring
  today's Ask timeouts. Cross-node retry ONLY on provably-unsent
  connect failures; never on DeadlineExceeded. Heartbeat stays fire-and-forget.
- StaticSitePskProvider: site's single own-key provider (fail-closed).
- CommunicationOptions: CentralTransport flag (default Akka) + CentralGrpcEndpoints
  (validator: required when transport=Grpc). Host selects the impl; the
  ClusterClient is created only on the Akka path.

Tests: actor-with-fake-transport (7 delegations + fault routing + heartbeat
no-fault), AkkaCentralTransport sender-forwarding, GrpcCentralTransport over
in-process TestServer (failover flip, sticky, failback, PSK+header, deadline,
no-retry-on-deadline), validator. Communication.Tests 371 green, Host.Tests 391
green; the three above-seam suites pass unmodified.

src/ZB.MOM.WW.ScadaBridge.Communication/CommunicationOptionsValidator.cs

@@ -66,6 +66,19 @@ public sealed class CommunicationOptionsValidator : OptionsValidatorBase<Communi
         builder.RequireThat(options.GrpcMaxConcurrentStreams > 0,
             $"ScadaBridge:Communication:GrpcMaxConcurrentStreams must be positive (was {options.GrpcMaxConcurrentStreams}).");
 
+        // The gRPC site→central transport needs at least one central endpoint to dial. Only
+        // enforced when that transport is selected — the default Akka path ignores the list, so a
+        // node on ClusterClient must not be forced to declare gRPC endpoints it never uses.
+        if (options.CentralTransport == CentralTransportMode.Grpc)
+        {
+            builder.RequireThat(
+                options.CentralGrpcEndpoints.Count > 0
+                    && options.CentralGrpcEndpoints.All(e => !string.IsNullOrWhiteSpace(e)),
+                "ScadaBridge:Communication:CentralGrpcEndpoints must list at least one non-empty "
+                + "central gRPC endpoint when CentralTransport is Grpc "
+                + $"(was {options.CentralGrpcEndpoints.Count} entr{(options.CentralGrpcEndpoints.Count == 1 ? "y" : "ies")}).");
+        }
+
         // ── Aggregated live alarm cache (plan #10, Task 6) ───────────────────────
         // Linger drives a Timer dueTime; TimeSpan.Zero is valid (stop the aggregator
         // immediately when the last viewer leaves), only a negative value is invalid.