feat(cli): working audit verify-chain via the VerifyAuditChain management command (ScadaBridge#41)

verify-chain was a no-op stub that printed "not enabled" and exited 0 without
contacting the server. It now sends VerifyAuditChain(Month) over
POST /management and maps the verdict to the exit code: 0 intact or not
chained, 3 broken (first break: partition, ChainSeq, EventId, kind), 1 error,
2 unauthorized. Table and JSON renderings.

ManagementActor: new HandleVerifyAuditChain arm, gated on the OperationalAudit
roles (Administrator, Viewer) and refusing a site-scoped caller because a
month's chain spans every site; INVALID_ARGUMENT for a bad month, CHAIN_BUSY
when the chain lock is held; long-running Ask timeout. Result enums serialise
as names.

Parity: RequiredRoleMatrixTests freezes the gate; ManagementSurfaceParityTests
now probes `audit verify-chain` (the one audit leaf that is a management
contract) instead of skipping the whole audit group.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

tests/ZB.MOM.WW.ScadaBridge.ManagementService.Tests/RequiredRoleMatrixTests.cs

@@ -167,6 +167,11 @@ public class RequiredRoleMatrixTests
         ["FlowDebugRunScript"] = [Roles.Deployer],
         ["FlowDebugReplay"] = FlowDebuggerReplayers,
 
+        // ---- Audit reads (OperationalAudit) -----------------------------------------
+        // AuditLog hash-chain verification (ScadaBridge#41) carries audit query's
+        // OperationalAudit permission (alog.md §15.1); written out by hand to keep the freeze.
+        ["VerifyAuditChain"] = [Roles.Administrator, Roles.Viewer],
+
         // ---- Two-person secured write ----------------------------------------------
         ["SubmitSecuredWrite"] = [Roles.Operator],
         ["ApproveSecuredWrite"] = [Roles.Verifier],