fix(management): site-scope ListDataConnections + hoist scope checks above resolve/status oracles (arch-review 2026-08-19 P6-4 + P6-5)

P6-4: HandleListDataConnections took no user at all and returned EVERY
site's connections to any authenticated caller, nullifying the row-98
fail-closed gate on HandleGetDataConnection — Get denied exactly what List
handed over. DataConnectionPublicShape already scrubs secrets, so the leak
was site topology plus a connection-id existence oracle, but it still
defeated scoping. List now takes the AuthenticatedUser: an explicit SiteId
goes through EnforceSiteScope (the ListAreas shape), and an unfiltered list
from a site-scoped non-Administrator caller is narrowed to their permitted
sites (the ListSites shape). GetRequiredRoles is untouched — scoping is not
a role gate, so the frozen 138-command authz matrix is unaffected.

The Central UI Design > Connections page bypasses the actor entirely
(ISiteRepository.GetAllDataConnectionsAsync direct) and IS reachable by a
scoped user: it is gated RequireDesign, and SiteScopeService explicitly does
NOT exempt Designer (register row 86). It now filters sites through
SiteScope.FilterSitesAsync and keeps only their connections, mirroring
EventLogs/AlarmSummary.

P6-5: four handlers resolved their target — and on approve/reject reported
its status — BEFORE the scope check, so an out-of-scope caller could tell a
real id from a fake one, and read a secured write's lifecycle status, from
the error shape alone. The scope check is hoisted above the not-found and
status checks in HandleSubmitSecuredWrite, HandleApproveSecuredWrite,
HandleRejectSecuredWrite and HandleDebugSnapshot, with the unresolvable case
routed through the existing DenyUnresolvedTargetIfScoped so the denial is
identical whether or not the target exists. System-wide callers keep their
ordinary not-found/status answers, and the P6-1 CAS semantics on
approve/reject are unchanged (only the checks above the CAS moved).

Tests: 8 new ManagementService tests + 2 CentralUI bUnit tests, all verified
to FAIL against the unfixed handlers (src reverted, tests re-run) and pass
after — including the unscoped/Administrator control cases proving behaviour
for system-wide callers is unchanged. Full ManagementService.Tests 545 green,
CentralUI.Tests 1073 green.

src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Pages/Design/DataConnections.razor

@@ -8,6 +8,7 @@
 @attribute [Authorize(Policy = AuthorizationPolicies.RequireDesign)]
 @implements IDisposable
 @inject ISiteRepository SiteRepository
+@inject ZB.MOM.WW.ScadaBridge.CentralUI.Auth.SiteScopeService SiteScope
 @inject IConnectionHealthQueryService ConnectionHealthQuery
 @inject NavigationManager NavigationManager
 @inject IDialogService Dialog
@@ -305,8 +306,16 @@
         _errorMessage = null;
         try
         {
-            var sites = await SiteRepository.GetAllSitesAsync();
-            _connections = (await SiteRepository.GetAllDataConnectionsAsync()).ToList();
+            // Site scoping (arch-review 2026-08-19 P6-4): this page reads the repository
+            // directly, bypassing ManagementActor's scope gate, and Designer is NOT
+            // exempt from site scope (see SiteScopeService) — so a scoped Designer used
+            // to see every site's connections here. Filter the sites, then keep only the
+            // connections belonging to them, mirroring EventLogs/AlarmSummary.
+            var sites = await SiteScope.FilterSitesAsync(await SiteRepository.GetAllSitesAsync());
+            var permittedSiteIds = sites.Select(s => s.Id).ToHashSet();
+            _connections = (await SiteRepository.GetAllDataConnectionsAsync())
+                .Where(c => permittedSiteIds.Contains(c.SiteId))
+                .ToList();
 
             var connBySite = _connections.GroupBy(c => c.SiteId).ToDictionary(g => g.Key, g => g.ToList());
             _treeRoots = sites.Select(site => new DcTreeNode(