fix(validation): close Theme 3 — 11 input-validation / unbounded-input findings

Each finding is a focused validation guard or upper bound at a trust boundary.
Highlights:
- Commons-015: EncryptionMetadata ctor now validates Algorithm (AES-256-GCM
  only), Kdf (PBKDF2-SHA256 only), Iterations ([100k, 10M]), non-null Salt/IV.
- Transport-004: new BundleUnlockRateLimiter (sliding-window, per-key,
  singleton) wired into BundleImporter.LoadAsync; over-budget callers see
  BundleUnlockRateLimitedException. Per-bundle 3-strike + per-window cap.
- ESG-022: ExternalSystemClient.InvokeHttpAsync allow-lists the documented
  GET/POST/PUT/PATCH/DELETE set (case-insensitive); unknown verbs throw.
- SEL-015: SiteEventLogger queue now bounded (10k cap, DropOldest); dropped
  events fault their Task and increment FailedWriteCount so the drop is
  observable instead of an unbounded memory growth.
- SEL-017: EventLogQueryService clamps caller-supplied PageSize to a new
  MaxQueryPageSize cap (default 500) so int.MaxValue can't OOM the host.
- SEL-020: LogEventAsync rejects severities outside {Info, Warning, Error}
  (matches SQLite BINARY-collation query filter).
- InboundAPI-020: ContentType "json" check now case-insensitive
  (application/JSON no longer slips through as not-json).
- InboundAPI-024: _knownBadMethods capped at 1000 entries (drops new entries
  once full); per-request DB lookup remains the correctness path.
- SR-025: HandleSetStaticAttribute validates the attribute name against the
  deployed config; unknown names now return Success=false instead of
  leaking orphan override rows into the SQLite store.
- TE-021: MoveTemplateAsync runs the sibling-name-collision check at the
  destination, mirroring TemplateFolderService.MoveFolderAsync.
- TE-022: LockEnforcer's once-locked-stays-locked rule now also covers
  LockedInDerived (was previously only IsLocked).

New regression tests across 8 test projects (EncryptionMetadata, rate
limiter, ESG client allow-list, SEL bounded channel / PageSize clamp /
severity validation, InboundAPI ContentType + bad-methods cap, SiteRT
unknown-attribute, TemplateEngine MoveTemplate + LockedInDerived).
Build clean; affected suites all green. README regenerated: 93 open (was 104).

Note: a separate manual re-run was needed for the SiteEventLogging hunk
because its initial subagent's source edits never landed on disk despite
reporting success (file-collision-style failure mode).

tests/ScadaLink.InboundAPI.Tests/InboundScriptExecutorTests.cs

@@ -362,6 +362,52 @@ public class InboundScriptExecutorTests
         Assert.True(_executor.CompileAndRegister(good));
     }
 
+    // --- InboundAPI-024: _knownBadMethods must be bounded so a spam attack of
+    //     unique method names cannot grow the cache without bound. ---
+
+    [Fact]
+    public void KnownBadMethodsCache_SizeNeverExceedsCap_UnderUniqueNameFlood()
+    {
+        // Flood the executor with bad-method names well past the cache cap. The
+        // cache must stabilise at or below the cap — any further unique bad name
+        // is dropped rather than added (the per-request DB lookup remains the
+        // correctness path; this cache is only a fast-fail optimisation).
+        const int cap = 1000;
+        const int floodCount = cap + 500;
+
+        for (var i = 0; i < floodCount; i++)
+        {
+            var bad = new ApiMethod($"bad-{i}", "%%% invalid %%%") { Id = i + 1, TimeoutSeconds = 10 };
+            Assert.False(_executor.CompileAndRegister(bad));
+        }
+
+        Assert.True(
+            _executor.KnownBadMethodCount <= cap,
+            $"known-bad cache size {_executor.KnownBadMethodCount} must not exceed cap {cap}");
+    }
+
+    [Fact]
+    public async Task KnownBadMethodsCache_LazyCompilePath_AlsoCappedUnderUniqueNameFlood()
+    {
+        // The lazy-compile path (ExecuteAsync on an unregistered method) records
+        // failures via the same capped helper as CompileAndRegister, so flooding
+        // it with unique URLs must not grow the cache without bound.
+        const int cap = 1000;
+        const int floodCount = cap + 250;
+
+        for (var i = 0; i < floodCount; i++)
+        {
+            var method = new ApiMethod($"lazy-bad-{i}", "%%% invalid %%%") { Id = i + 1, TimeoutSeconds = 10 };
+            var result = await _executor.ExecuteAsync(
+                method, new Dictionary<string, object?>(), _route, TimeSpan.FromSeconds(10));
+            Assert.False(result.Success);
+        }
+
+        Assert.True(
+            _executor.KnownBadMethodCount <= cap,
+            $"known-bad cache size {_executor.KnownBadMethodCount} must not exceed cap {cap}");
+    }
+
     // --- InboundAPI-014: the script return value is validated against ReturnDefinition ---
 
     [Fact]