feat(inbound-api): audit central method-script Database.* calls (DbOutbound) and feed the flow-trace sink

InboundDatabaseHelper gains trailing optional auditWriter / nodeIdentity /
executionId / parentExecutionId / methodName / traceSink parameters; every
QuerySingle/Query/Execute writes one DbOutbound/DbWrite row (Delivered/Failed,
Target = connection name, Actor = 'api:{method}', DurationMs, SQL + parameters
as RequestSummary, Extra in the site's {op, rowsAffected|rowsReturned}
vocabulary, SourceNode) via ICentralAuditWriter — best-effort, never into the
script; the same instance goes to the RouteHelper trace sink first. Closes the
audit-scope gap Component-AuditLog.md already claimed (plan D7). Redaction and
the 8 KB cap apply at write time in the shared redactor, as for site rows.

Claude-Session: https://claude.ai/code/session_01NcMG6xXdsJbmD2wYAgkK29

src/ZB.MOM.WW.ScadaBridge.InboundAPI/RouteHelper.cs

@@ -164,6 +164,14 @@ public class RouteHelper
         new(_instanceLocator, _instanceRouter, _deadlineToken, _requestAbortedToken, _parentExecutionId,
             _auditWriter, _nodeIdentity, _trace, traceSink);
 
+    /// <summary>
+    /// Flow Debugger outbound calls (plan 2026-09-06, D5/D7): the trace sink this helper carries,
+    /// so <see cref="InboundScriptExecutor"/> can hand the SAME delegate to the script's
+    /// <see cref="InboundDatabaseHelper"/> and a Live run's central <c>Database.*</c> rows land
+    /// in the same collector as its <c>RouteCall</c> rows. Null when no sink was attached.
+    /// </summary>
+    public Action<AuditEvent>? TraceSink => _traceSink;
+
     /// <summary>
     /// Creates a route target for the specified instance.
     /// </summary>