feat(cli): working audit verify-chain via the VerifyAuditChain management command (ScadaBridge#41)

verify-chain was a no-op stub that printed "not enabled" and exited 0 without
contacting the server. It now sends VerifyAuditChain(Month) over
POST /management and maps the verdict to the exit code: 0 intact or not
chained, 3 broken (first break: partition, ChainSeq, EventId, kind), 1 error,
2 unauthorized. Table and JSON renderings.

ManagementActor: new HandleVerifyAuditChain arm, gated on the OperationalAudit
roles (Administrator, Viewer) and refusing a site-scoped caller because a
month's chain spans every site; INVALID_ARGUMENT for a bad month, CHAIN_BUSY
when the chain lock is held; long-running Ask timeout. Result enums serialise
as names.

Parity: RequiredRoleMatrixTests freezes the gate; ManagementSurfaceParityTests
now probes `audit verify-chain` (the one audit leaf that is a management
contract) instead of skipping the whole audit group.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

src/ZB.MOM.WW.ScadaBridge.Commons/Messages/Management/AuditLogCommands.cs

@@ -23,3 +23,11 @@ public record QueryAuditLogCommand(
 /// <param name="Entries">The page of configuration-change audit entries.</param>
 /// <param name="TotalCount">Total number of rows matching the filters (unpaged).</param>
 public record AuditLogQueryResult(IReadOnlyList<AuditLogEntry> Entries, int TotalCount);
+
+/// <summary>
+/// Verifies the central AuditLog hash chain for one UTC calendar month (audit roadmap T1,
+/// ScadaBridge#41). Read-only; gated on the OperationalAudit roles and refused for a
+/// site-scoped caller, because a month's chain spans every site.
+/// </summary>
+/// <param name="Month">The month to verify, <c>YYYY-MM</c>.</param>
+public record VerifyAuditChainCommand(string Month);