feat(grpc): host CentralControlService on the central node (T1A.2)

Central now ALSO listens for the seven site→central control messages over
gRPC, alongside the existing ClusterClient path. Nothing flips to gRPC yet —
sites keep CentralTransport=Akka (T1A.3's job); central simply starts also
accepting.

- CentralControlGrpcService (Communication.Grpc): decodes each RPC onto the
  SAME in-process message the ClusterClient path carries, Asks the existing
  CentralCommunicationActor (zero handler-logic changes), encodes the reply via
  the T1A.1 mapper. Readiness-gated like SiteStreamGrpcServer.SetReady —
  Unavailable until AkkaHostedService hands the actor over. Heartbeat stays
  fire-and-forget (Tell, always-OK, never gated on readiness). Ingest reuses the
  shared SiteStreamGrpcServer.AuditIngestAskTimeout constant. Fault→status
  mapping is retry-aware: Unavailable (never dispatched, safe to cross-node
  retry) vs DeadlineExceeded/Internal (it ran, do not re-send elsewhere).

- CentralControlAuthInterceptor (Host): a SEPARATE interceptor class, not a
  variant constructor on ControlPlaneAuthInterceptor. Central's model is per-site
  (verify the Bearer token against the key for the site in the required
  x-scadabridge-site header, via ISitePskProvider) where a site verifies its one
  own-key — a genuinely different model. Fail-closed on every branch: missing or
  blank header, unresolvable key, and mismatched token all → PermissionDenied,
  never pass-through. One public constructor only (the explicit-prefix ctor is
  internal), pinned by a reflection test — a second public ctor makes
  Grpc.AspNetCore's GetFactory() throw per-call and silently disables the gate.

- Explicit Kestrel h2c listener on new option ScadaBridge:Node:CentralGrpcPort
  (default 8083, symmetric with sites), mirroring the Site branch. Additive to
  central's :5000 HTTP/1 surface, which is untouched — gRPC does NOT go through
  Traefik (HTTP/1 only). Registered by type on AddGrpc; service mapped with
  MapGrpcService. Port range-validated by NodeOptionsValidator.

- Rig: publish the central gRPC port 9013:8083 / 9014:8083 on both central nodes
  so a later task can exercise it.

Tests: CentralControlEndToEndTests (Host.Tests, TestServer + real interceptor +
real service over a stub actor) proves auth positives/negatives are
distinguishable and covers unary + the ingest bridge shapes; the interceptor is
registered BY TYPE, never in DI. CentralControlAuthInterceptorTests pins the
per-site gate + one-public-ctor invariant. CentralControlGrpcServiceTests
(Communication.Tests, TestKit) covers the readiness gate, fire-and-forget
heartbeat, and the DeadlineExceeded-vs-Unavailable status mapping. No active
<Protobuf> item. Communication.Tests (356) + Host.Tests (384) green.

src/ZB.MOM.WW.ScadaBridge.Host/Program.cs

@@ -97,6 +97,24 @@ try
         // Windows Service support (no-op when not running as a Windows Service)
         builder.Host.UseWindowsService();
 
+        // Explicit Kestrel h2c listener for the central-hosted gRPC control plane
+        // (CentralControlService). Mirrors the site branch's gRPC listener: HTTP/2-only,
+        // on its own port (default 8083, symmetric with the site GrpcPort — a node is
+        // either central or a site, never both). This is ADDITIVE to central's :5000
+        // HTTP/1 surface (Central UI + Management/Inbound API from ASPNETCORE_URLS),
+        // which is untouched: gRPC does NOT go through Traefik (HTTP/1 only), sites reach
+        // this port by container name. T1A.2 hosts the server here; sites keep dialing over
+        // Akka ClusterClient until T1A.3 flips CentralTransport — this listener simply also
+        // accepts.
+        var centralGrpcPort = configuration.GetValue<int>("ScadaBridge:Node:CentralGrpcPort", 8083);
+        builder.WebHost.ConfigureKestrel(options =>
+        {
+            options.ListenAnyIP(centralGrpcPort, listenOptions =>
+            {
+                listenOptions.Protocols = Microsoft.AspNetCore.Server.Kestrel.Core.HttpProtocols.Http2;
+            });
+        });
+
         // Shared components
         builder.Services.AddClusterInfrastructure();
         builder.Services.AddCommunication();
@@ -108,6 +126,22 @@ try
         // node uses for its single key). Registered before the clients that consume it.
         builder.Services.AddSingleton<
             ZB.MOM.WW.ScadaBridge.Communication.Grpc.ISitePskProvider, SitePskProvider>();
+
+        // Central-hosted gRPC control plane (T1A.2). CentralControlAuthInterceptor is the
+        // per-site sibling of the site's ControlPlaneAuthInterceptor: it verifies the Bearer
+        // token against the key for the site named in the required x-scadabridge-site header,
+        // resolved through the ISitePskProvider registered just above. Registered BY TYPE on
+        // AddGrpc exactly as the site branch registers its interceptors — NOT as a DI singleton,
+        // which would let DI hand the instance back and bypass Grpc.AspNetCore's own activation
+        // path (the shape that once hid a two-public-constructor defect until the rig caught it).
+        // CentralControlGrpcService decodes each request onto the same in-process message the
+        // ClusterClient path carries and Asks CentralCommunicationActor — zero handler logic here.
+        builder.Services.AddGrpc(options =>
+        {
+            options.Interceptors.Add<CentralControlAuthInterceptor>();
+        });
+        builder.Services.AddSingleton<
+            ZB.MOM.WW.ScadaBridge.Communication.Grpc.CentralControlGrpcService>();
         builder.Services.AddHealthMonitoring();
         builder.Services.AddCentralHealthAggregation();
         builder.Services.AddExternalSystemGateway();
@@ -462,6 +496,14 @@ try
         // Requires endpoint routing (app.UseRouting() above).
         app.MapZbMetrics();
 
+        // Central-hosted gRPC control plane (T1A.2) — the site→central CentralControlService.
+        // Runs on the dedicated h2c listener configured above (default :8083), gated by
+        // CentralControlAuthInterceptor and readiness-gated by the service itself (Unavailable
+        // until AkkaHostedService hands the CentralCommunicationActor over via SetReady). It
+        // shares the app's endpoint routing with the HTTP/1 surface; Kestrel steers each
+        // connection to the right pipeline by listener/protocol.
+        app.MapGrpcService<ZB.MOM.WW.ScadaBridge.Communication.Grpc.CentralControlGrpcService>();
+
         app.MapStaticAssets();
         app.MapCentralUI<ZB.MOM.WW.ScadaBridge.Host.Components.App>();
         app.MapInboundAPI();