docs(cli): row 76 — audit-config query JSON sample shows afterStateJson + bundleImportId

The `entries` array is a serialized `AuditLogEntry`, so both fields are always
on the wire; the README sample showed neither, which read as if the payload
were the seven columns the table projection happens to keep. Row 57 added that
projection and the table section already names both omitted fields — the JSON
sample above it was the stale half.

Added both to the sample and documented their nullability, which is the part a
script author actually needs: `afterStateJson` is the post-change snapshot
embedded as a string and is null for deletes (no after-state), `bundleImportId`
is the import session id when the change came from `transport import` and null
for a direct change. Also grew the sample from one entry to two so it now
mirrors the table-output sample directly below it row for row — the same 412
Template/Created and 413 ExternalSystem/Deleted pair — which is what makes the
"the table drops these two fields" sentence checkable against the JSON above it.

Docs only.

src/ZB.MOM.WW.ScadaBridge.CLI/README.md

@@ -1829,13 +1829,32 @@ Output shape:
       "entityType": "Template",
       "entityId": "7",
       "entityName": "PumpTemplate",
-      "timestamp": "2026-08-15T12:00:00+00:00"
+      "afterStateJson": "{\"Id\":7,\"Name\":\"PumpTemplate\",\"FolderId\":3}",
+      "timestamp": "2026-08-15T12:00:00+00:00",
+      "bundleImportId": null
+    },
+    {
+      "id": 413,
+      "user": "designer",
+      "action": "Deleted",
+      "entityType": "ExternalSystem",
+      "entityId": "3",
+      "entityName": "MES",
+      "afterStateJson": null,
+      "timestamp": "2026-08-15T12:05:00+00:00",
+      "bundleImportId": "9f2c1e40-5b31-4a7e-8d66-0c1a4b93ff21"
     }
   ],
   "totalCount": 137
 }
 ```
 
+Both nullable fields are always present on the wire. `afterStateJson` is a JSON snapshot
+of the entity's state *after* the change, embedded as a string — it is `null` for deletes,
+since there is no after-state. `bundleImportId` is the import session id when the change
+was made by a bundle import (`transport import`), and `null` for a change made directly;
+it is the join key for "what did this bundle actually change".
+
 `totalCount` is the unpaged number of rows matching the filters, so a client can page
 without a second call. JSON is the primary format for this command and is what scripts
 should consume — it is never altered by the table projection below.