feat(comm): extract SiteCommandDispatcher; site serves commands over gRPC too (T1B.2)

Refactor SiteCommunicationActor's central→site routing table into one
SiteCommandDispatcher — the single routing truth for the 28 migrated commands
(IntegrationCallRequest, the dead 29th, stays on the actor and out of the
dispatcher). The Akka actor and the new SiteCommandGrpcService both route through
one dispatcher instance so the two transports can never drift on where a command
goes. Server-side only: nothing central flips to gRPC yet (that is T1B.3);
ClusterClient remains the live path.

Decisions worth recording:

- Targets preserved byte-for-byte. Lifecycle/OPC UA/query/route → the Deployment
  Manager singleton proxy; DeployArtifacts/EventLog/parked → their null-guarded
  handlers with the exact same "handler not available" replies; the parked
  handler stays NODE-LOCAL (per-node replicated-store owner), never the singleton
  proxy — pinned by a dispatcher test that asserts the target is the parked probe
  and NOT the dm proxy.

- Sender preservation intact. The actor's command handlers became thin
  DispatchCommand delegations that still Forward (central Ask → reply routes
  straight back); the existing SiteCommunicationActorTests pass unchanged, which
  is the regression guard for that plumbing. UnsubscribeDebugView keeps its
  fire-and-forget shape: the actor Forwards, the gRPC service Tells + returns the
  synthetic UnsubscribeDebugViewAck so a unary RPC still answers.

- Ack-before-Leave on failover. The dispatcher's PrepareFailover resolves the
  standby with a DRY-RUN (no leave) to build the ack, and hands back a deferred
  CommitLeave; the gRPC service returns the ack, then schedules the real
  Cluster.Leave — so a caller reaching the very node about to leave still gets its
  ack instead of a broken stream. The actor path keeps today's coupled
  resolve-and-leave (over ClusterClient the ack Tell only enqueues, so order is
  immaterial). Proven at both levels: a dispatcher test asserts the ack is built
  before CommitLeave runs, and a TestServer test asserts the recorded seam order
  is resolve-then-leave.

- ControlPlaneAuthInterceptor gates SiteCommandService by EXTENDING
  DefaultGatedPrefixes (descriptor-derived), not by adding a constructor — the
  one-public-ctor invariant and its test stay green.

Tests: SiteCommandDispatcherTests (28-command routing incl. parked node-locality
and both failover paths) and SiteCommandGrpcService TestServer tests (auth,
readiness→Unavailable, one command per oneof group, failover ordering). Full
solution build 0/0; Communication.Tests 574 and Host.Tests 377 green. No active
<Protobuf> item.

src/ZB.MOM.WW.ScadaBridge.Host/ControlPlaneAuthInterceptor.cs

@@ -51,12 +51,18 @@ namespace ZB.MOM.WW.ScadaBridge.Host;
 public sealed class ControlPlaneAuthInterceptor : Interceptor
 {
     /// <summary>
-    /// Service prefixes gated by default. Read from the generated <c>sitestream.proto</c>
-    /// package/service names — <c>package sitestream; service SiteStreamService</c>.
-    /// Later phases append their own services here.
+    /// Service prefixes gated by default. Read from the generated service descriptors —
+    /// <c>package sitestream; service SiteStreamService</c> (real-time data + audit pull) and
+    /// <c>package scadabridge.sitecommand.v1; service SiteCommandService</c> (the T1B command
+    /// plane). Later phases append their own services here rather than adding a second
+    /// interceptor or constructor (see the public constructor's remarks).
     /// </summary>
     public static readonly IReadOnlyList<string> DefaultGatedPrefixes =
-        new[] { "/sitestream.SiteStreamService/" };
+        new[]
+        {
+            $"/{SiteStreamService.Descriptor.FullName}/",
+            $"/{SiteCommandService.Descriptor.FullName}/",
+        };
 
     private readonly IReadOnlyList<string> _gatedPrefixes;
     private readonly IOptions<CommunicationOptions> _options;